DMARC record generator
Build a DMARC TXT record for your domain, then check the DMARC record that domain publishes today.
- Build and check
- Free, no sign-up
Build the TXT record for _dmarc, then check the DMARC record this domain publishes today.
Alignment and reports
Building the record stays in this tab. Checking a domain sends the _dmarc name to Cloudflare DNS and reads the TXT record published today. Free to use, no account. More seo tools
How to use it
- Enter the domain and choose a policy.
- Add a report address and read the TXT record for _dmarc.
- Press Check the published record to read the DMARC record that domain publishes today.
How the policy is written
The record starts with v=DMARC1 and a policy: none delivers the mail and asks for reports, quarantine asks receivers to treat failing mail as spam, and reject asks them to refuse it. A subdomain policy is written when it differs. Percent omitted at 100 applies to all mail. Aggregate reports (rua) and failure reports (ruf) are mailto addresses. Relaxed alignment is the usual DKIM and SPF setting and is left off the record; strict alignment is written as adkim=s or aspf=s.
The host is _dmarc in front of the domain. Check the published record asks Cloudflare’s public DNS for the TXT record at that host today. When an aggregate address sits at another organisation, receivers look for a TXT record at your domain’s name under _report._dmarc on the report host, and the check looks for that record too. A second DMARC record on the same host is a permanent error.
Private by design
Privacy
The record is built in this tab. Checking a domain sends the _dmarc name to Cloudflare’s public DNS and reads the TXT record it publishes today.
This page also shows Google ads, which can use cookies. Privacy and cookies explains how.
Questions
What does a DMARC record do?
It tells receivers what to do with mail that fails SPF or DKIM alignment, and where to send reports. It is a TXT record at _dmarc.your domain.
Which policy should a new record use?
p=none delivers the mail and collects reports, which is a calm place to start. Quarantine treats failing mail as spam. Reject asks receivers to refuse it.
Where do the reports go?
To the mailto address in rua, and failure samples to ruf when you set one. An address at another organisation needs a TXT record that authorises your domain.
How do I see the record that is live today?
Enter the domain and press Check the published record. The page reads the TXT record at _dmarc through Cloudflare’s public DNS.