DMARC Record Builder
Updated .
This builder assembles a DMARC TXT record from your domain, policy and report address, checks the values for common mistakes, and prints the exact DNS name to publish it at (_dmarc. followed by your domain). It recommends a staged path from p=none to quarantine to reject. It only builds text: it does not look anything up and does not change your DNS.
How it works
A DMARC record is a single DNS TXT record published at _dmarc. followed by your domain. Its tags are separated by semicolons, and the specification (RFC 7489) requires v=DMARC1 first and p= second. The builder adds the rest in a fixed order:
- v=DMARC1 — the version tag.
- p= — what receivers should do with mail that fails:
none,quarantineorreject. - sp= — added only if you chose a different policy for subdomains.
- rua=mailto:… — added only if you entered a report address.
- pct= — added only if you entered a number below 100.
- adkim=s and aspf=s — added only if you chose strict alignment, because relaxed is the default.
How DMARC decides. A message passes DMARC when SPF or DKIM passes and the domain it authenticates lines up with the domain in the visible From address. SPF is defined in RFC 7208 and DKIM in RFC 6376. This tool does not build or check either of them, so before you move past p=none, confirm that every service sending mail as your domain, such as your mail provider, invoicing system, newsletter tool and CRM, is covered by SPF or signs with DKIM for your domain. The SPF, DKIM and DMARC guide walks through that check.
Staged rollout. Start with p=none and a monitored report address, read the reports for a few weeks, fix legitimate senders that fail, then move to quarantine and finally reject. Jumping straight to reject can block your own invoices and newsletters. Publishing the record is done in your DNS host’s control panel, which this page never touches. Some hosts want only _dmarc in the name field and add your domain themselves; the builder shows both forms.
Worked example
Suppose, as a hypothetical, the domain is example.com (a name reserved for examples), the policy is none, and the report address is dmarc-reports@example.com, with the other options left on their defaults.
The builder prints the full DNS name _dmarc.example.com, the short name _dmarc, and the value v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com. Because the report address is at the same domain, no extra authorisation record is needed.
If the same example chose quarantine and a percentage of 25, the value would become v=DMARC1; p=quarantine; rua=mailto:dmarc-reports@example.com; pct=25. If the report address were at a different domain, the builder would note that the receiving domain must first publish an authorisation record. All names here are invented for illustration.
Frequently asked questions
Does DMARC stop all phishing?
No. It makes it harder for others to send mail that passes as your exact domain. It does not stop look-alike domains or phishing sent from a compromised account, so it works alongside the other controls.
Why start with p=none?
It changes nothing about delivery but starts the reports, so you can find legitimate services that fail before any mail is affected. Moving to quarantine or reject without that step can block your own mail.
Do I need a report address?
You can publish without one, but you would be blind to what is failing. A monitored mailbox, or a reporting service you trust, is strongly advisable before moving past p=none.
What if my DNS host rejects the value?
Check that only one DMARC record exists, that the name is entered the way your host expects (the full name or only _dmarc), and that quotes are handled as your host requires. Long values may need splitting into several strings.
Does this look up or change my DNS?
No. It only builds text in your browser. You publish the record yourself in your DNS host’s control panel, and nothing you type is sent or stored.
Want the briefing in your inbox?
The briefing is published on this site every morning. The email edition is not sending yet — leave your address and you’ll be among the first told when it starts. Nothing is sent in the meantime.