DMARC Record Generator

What is a DMARC Record?

DMARC — short for Domain-based Message Authentication, Reporting & Conformance — is an email authentication protocol that tells receiving mail servers what to do with emails that fail SPF or DKIM checks. Published as a DNS TXT record under _dmarc.yourdomain.com, a DMARC policy protects your domain from being impersonated in phishing attacks, business email compromise (BEC), and spam campaigns.

Without DMARC, any attacker can send emails that appear to come from your domain. This puts your brand reputation, customer trust, and email deliverability at serious risk. DMARC closes that gap by giving domain owners visibility and enforcement control over their email channel.

DMARC works alongside two complementary standards:

• SPF (Sender Policy Framework) — specifies which mail servers are authorised to send email on behalf of your domain.
• DKIM (DomainKeys Identified Mail) — adds a cryptographic signature to emails so recipients can verify the message came from an authorised server and was not tampered with in transit.

When both SPF and DKIM are in place, DMARC ties them together and adds enforcement policy and detailed reporting capabilities.

How to Use Our Free DMARC Generator

Generating a DMARC record takes under two minutes — no technical background needed.

1. Enter your domain — type your root domain (e.g. example.com) without any prefix like "www" or "mail".
2. Select your ESP — choose your Email Service Provider from the dropdown. The tool shows platform-specific recommendations automatically.
3. Choose a DMARC policy — start with none if you are new to DMARC (monitoring only). Move to quarantine or reject once you have reviewed your aggregate reports.
4. Enter your report email — provide an email address to receive daily DMARC aggregate XML reports.
5. Configure advanced settings (optional) — set alignment modes, subdomain policy, forensic reports, and percentage.
6. Click Generate — copy your DMARC TXT record and paste it into your DNS settings.

DMARC Tag Reference

Understanding each DMARC tag helps you craft a policy that fits your sending patterns precisely.

DMARC Record Examples

1. Monitoring Mode (none) — Recommended Starting Point

Collect data without affecting any email delivery. Use this for 2–4 weeks before enforcing.

v=DMARC1; p=none; rua=mailto:dmarc@example.com;

2. Quarantine Mode — Intermediate Enforcement

Failing emails are moved to spam. The pct=50 tag applies the policy to only half of failing messages during rollout.

v=DMARC1; p=quarantine; pct=50; rua=mailto:dmarc@example.com; adkim=r; aspf=r;

3. Reject Mode — Maximum Protection

Failing emails are blocked entirely. Only enable this once aggregate reports confirm all legitimate mail passes authentication.

v=DMARC1; p=reject; rua=mailto:dmarc@example.com; adkim=s; aspf=s;

SPF vs DKIM vs DMARC — What's the Difference?

Best DMARC Settings for Cold Email

If you send cold outreach or run lead generation campaigns, DMARC configuration is essential for landing in the inbox rather than the spam folder.

• Use a dedicated sending domain — never cold email from your primary business domain. Use a dedicated subdomain or alternative domain such as outreach.yourcompany.com.
• Start with p=none — monitor email streams for 2–4 weeks before enforcing any policy on a new sending domain.
• Enable DKIM on every inbox — all sending inboxes must have DKIM configured. DMARC is unreliable without DKIM passing.
• Use relaxed alignment (adkim=r; aspf=r;) — strict alignment can break subdomain-level setups used by sequencing tools like Instantly and Smartlead.
• Warm up your inboxes first — even with perfect DMARC, SPF, and DKIM, cold inboxes land in spam without inbox warm-up. Use Warmbase to build inbox reputation automatically before launching any campaign.
• Monitor aggregate reports weekly — review DMARC reports to catch rogue sending sources or authentication failures early.

Common DMARC Mistakes to Avoid

• Jumping straight to p=reject — without reviewing reports first, you risk blocking legitimate marketing tools, CRMs, or automated systems.
• No rua address — without aggregate report emails you are flying blind. Always set the rua tag.
• SPF with too many lookups — SPF has a 10-DNS-lookup limit. Exceeding it causes SPF failures that break DMARC alignment.
• Strict alignment with forwarding — email forwarding breaks SPF alignment. Use relaxed mode (aspf=r) unless you have verified no forwarding occurs.
• Forgetting subdomains — if you send from subdomains, add an sp tag or set separate DMARC records for each subdomain.
• Setting DMARC without DKIM — DMARC requires either SPF or DKIM to pass and align. Without DKIM, your pass rate will be unreliable.
• Never graduating past p=none — monitoring mode provides no protection against spoofing. Plan to move to enforcement once your reports are clean.

Troubleshooting DMARC