DMARC Record Generator
Build a valid DMARC record - choose your policy, add reporting, and copy the DNS TXT record.
Build your DMARC record
DMARC is the policy layer on top of SPF and DKIM. Without it, phishing and brand impersonation are trivial - and since 2024, Gmail, Outlook and Yahoo require it for bulk senders. Choose your policy, set a percentage to phase enforcement in gradually, and add an address to receive aggregate reports. The generator assembles a valid v=DMARC1 record for you to publish at _dmarc.yourdomain.com.
The record's power comes from alignment: it checks that the visible From domain matches the domain SPF or DKIM authenticated, which is what makes DMARC stronger than either on its own. Publish at p=none with reporting first, watch the reports until your legitimate senders all pass, then tighten to quarantine and reject.
Full DMARC tag reference
Only v and p are required. rua is technically optional but you get no reports and no visibility without it, so always include it.
| Tag | Required | What it does |
|---|---|---|
| v | Yes | Version. Must be DMARC1 and first. |
| p | Yes | Domain policy: none, quarantine or reject. |
| sp | No | Subdomain policy. Inherits p if omitted. |
| rua | Recommended | Aggregate report address. rua=mailto:dmarc@you.com |
| ruf | No | Forensic per-message reports. Many providers don't send these. |
| pct | No | Percent of failing mail the policy applies to. Default 100. |
| adkim / aspf | No | Alignment mode for DKIM / SPF: r relaxed (default) or s strict. |
Deploy DMARC step by step
The whole rollout typically takes 6 to 12 weeks. Don't skip to reject - you'll block your own mail.
Adding it in your DNS panel
Publish the generated string as a TXT record with host _dmarc. The exact steps by registrar:
| Provider | Steps |
|---|---|
| Cloudflare | DNS > Add record > TXT > Name _dmarc > paste the value > DNS only > Save. |
| GoDaddy | My Products > DNS > Add > TXT > Host _dmarc > Value: paste > TTL 1 Hour > Save. |
| Namecheap | Domain List > Manage > Advanced DNS > Add New Record > TXT > Host _dmarc > paste. |
| Porkbun | Domain Management > DNS > Add TXT > Subdomain _dmarc > Answer: paste > Save. |
DMARC and cold email
Cold email is under heavier scrutiny than regular mail, and a DMARC record is one of the clearest signals of legitimacy. Missing it means running on two of the three authentication pillars. For brand-new domains still in warmup (the first 2 to 4 weeks), p=none is the safe setting while you confirm everything passes.
One rule is non-negotiable: cold email should always go through separate domains from your primary business domain, and each of those domains needs its own SPF, DKIM, DMARC and MX. That isolation is what protects your main domain's reputation if a cold campaign runs into trouble.
Record examples
From first-day monitoring to full enforcement.
v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.comv=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain.com; ruf=mailto:af@yourdomain.comv=DMARC1; p=reject; rua=mailto:dmarc@yourdomain.com; adkim=s; aspf=sFrequently asked questions
Where does the DMARC record go?
Publish it as a TXT record at _dmarc.yourdomain.com in your DNS provider's panel, not at the root domain. Use a TTL of about 3600.
What policy should I start with?
Start at p=none with a rua reporting address so you can see who sends as your domain without affecting delivery, then move to quarantine and reject once every legitimate sender passes.
Do I need DMARC?
For bulk sending to Gmail, Outlook and Yahoo, yes - it's required as of 2024. For cold email it's effectively mandatory: without it you're missing a third of the authentication stack and look less legitimate to receivers.
What is the pct tag for?
pct applies your policy to only a percentage of failing mail, so you can phase enforcement in gradually (for example pct=25) before applying it to everything.
Can I use DMARC without DKIM?
Technically yes, via SPF alignment alone, but it's not recommended. DKIM survives forwarding where SPF doesn't, so a DKIM-plus-DMARC setup is far more reliable. Set up both.
How long does DMARC take to work?
The record is active within an hour or two of publishing, and reports begin arriving in 24 to 48 hours. A full rollout from none to reject typically takes 6 to 12 weeks.
Next steps
Stop configuring DNS by hand
Cladiant provisions real Google Workspace, Microsoft 365, and Azure Entra mailboxes with SPF, DKIM, and DMARC written and verified on every domain before a single message sends. No DNS headaches, no authentication gaps, one invoice.