Skip to main content
Skip to generator
Free DMARC record builder

Build a DMARC recordthat won't break your email.

Guided setup with safe defaults. Copy your record in under a minute, then publish it with the steps for your DNS host.

Built in under a minuteSafe defaultsAll DNS hosts coveredFree, no signup

Enforcement level

Start gentle, tighten later.

DMARC sends weekly aggregate reports showing who is sending email as your domain. Useful for spotting spoofers and confirming your own setup.

Comma-separate multiple addresses.

Apply the policy to this share of failing email. Useful for staged rollouts.

Ignored when policy is Monitor only.

SPF alignment

Strict requires an exact domain match; relaxed allows subdomains.

DKIM alignment

Strict requires an exact domain match; relaxed allows subdomains.

_dmarc.yourdomain.com
Waiting
DMARC recordTYPE TXT
Your DMARC record will appear here as you fill out the form

Then add it as a TXT record at _dmarc in your DNS host.

What DMARC does, in one paragraph

DMARC tells mailbox providers like Gmail and Outlook what to do with email that claims to be from your domain but fails authentication. Without it, anyone can send messages pretending to be you, and even your real email can land in spam. With it, providers trust your domain and your customers see your messages.

The three enforcement levels, explained

Most businesses move through them in order. Start at the top, finish at the bottom.

Monitor only

p=none

DMARC reports what would have happened, without blocking anything. Every business should start here for at least 2 to 4 weeks to confirm legitimate email passes authentication before tightening the policy.

Quarantine suspicious

p=quarantine

Failed messages go to the recipient's spam folder instead of the inbox. Move here once your monitoring shows real email is passing, usually after a few weeks.

Reject impostors

p=reject

Failed messages are blocked outright before they reach the recipient. The strongest protection, recommended once your setup is proven stable. Most established domains end up here.

After you publish the record

A short timeline so you know what to expect.

  1. Minutes

    Record propagates

    Most DNS hosts publish the TXT record within minutes. GoDaddy and a few others can take up to an hour.

  2. Days

    Reports start arriving

    If you added a reporting address, expect daily aggregate reports from Gmail, Yahoo, and others within 24 to 72 hours.

  3. Weeks

    Tighten the policy

    Once your reports show legitimate email is passing, raise enforcement from p=none to p=quarantine, then to p=reject.

Or skip the manual setup entirely.

Let MailAfiniti manage DMARC automatically

From $1.50/user/month, billed annually · No credit card required