DMARC Record Generator: Build Your _dmarc TXT Record

DMARC tells receiving mail servers what to do with email that claims to come from your domain but fails SPF and DKIM checks, and it sends you reports on who is sending as you. It lives in a single TXT record at _dmarc.yourdomain. Fill in the form below and the generator writes that record for you, checks the syntax, and tells you where it goes. The safe way to start is p=none with a report address: you see who is sending as you without blocking anything, then tighten to quarantine and reject once your legitimate senders all pass.

Where the record goes

Log in to whoever hosts your DNS (often your domain registrar, Cloudflare, or your web host) and add a new record:

• Type: TXT
• Name / host: _dmarc. Some control panels want the full name, _dmarc.example.co.uk; if yours adds the domain automatically, entering the full name creates _dmarc.example.co.uk.example.co.uk, which will not work.
• Value: the record from the generator, starting v=DMARC1;.

Only publish one DMARC record per domain. If a _dmarc TXT record already exists, edit it rather than adding a second one: receivers ignore DMARC entirely when they find more than one.

Before you move past p=none

DMARC passes when a message passes SPF or DKIM and the domain that passed matches the domain in the visible From address. Third-party senders are the usual reason legitimate mail fails: your newsletter platform, invoicing system, CRM or website contact form may send as your domain without being set up for DKIM. Read your aggregate reports for a few weeks, fix each legitimate sender, then step up to p=quarantine and finally p=reject. Going straight to reject on day one is the quickest way to lose your own invoices to spam folders.

If your report address is on a different domain from the one you are protecting (for example a reporting service), that domain must publish a small authorisation record, or receivers will not send the reports. Reputable DMARC reporting services set this up for you; the generator shows the record needed when the domains differ.

DMARC also matters for cyber insurance. Email spoofing and invoice fraud sit behind many social engineering claims, and some insurers now ask on the proposal form whether you have SPF, DKIM and DMARC in place.