DMARC is the policy layer that sits on top of SPF and DKIM: it tells receivers what to do when a message fails authentication, and where to send the reports that show who is sending mail as your domain. Without it, a failed check produces no consistent action, and spoofed mail can keep flowing. This builder writes the DMARC TXT record from your choices: the policy for the domain, the policy for subdomains, the percentage of mail to apply it to, and the addresses that should receive aggregate and forensic reports. Publish it at _dmarc.yourdomain and your domain gains a real, enforced mail policy.
Quick Answer: Choose a policy, add reporting addresses, and click Build DMARC Record.
Free Online Tool
DMARC Record Builder
Build a DMARC policy TXT record from policy, subdomain policy, and reporting addresses.
How to Use the DMARC Record Builder
- Choose the policy: none for monitoring, quarantine for spam folder, reject for blocking.
- Choose the subdomain policy, or leave it to inherit the main policy.
- Enter the aggregate report address that receives daily summaries.
- Optionally enter a forensic report address for detailed failure samples.
- Set the percentage of mail the policy applies to.
- Click Build DMARC Record and publish the value at _dmarc.yourdomain.
Key Features
- Builds the full v=DMARC1 record from structured fields.
- Supports p, sp, rua, ruf, pct, adkim, and aspf tags.
- Explains each policy level in plain language.
- Validates report addresses before including them.
- Produces the _dmarc hostname to publish under.
- Runs entirely in the browser; nothing is published automatically.
What the Result Means
The p tag is the action for mail that fails DMARC: none means take no action but report, quarantine means deliver to spam, and reject means block it. The sp tag does the same for subdomains, and pct lets you roll a strict policy out gradually, starting at a small percentage and raising it as reports confirm legitimate mail passes. The rua reports are the real prize: daily aggregate reports show every source sending as your domain, authorised or not, which is how spoofing gets discovered.
Worked Example
A company that has monitored reports for a month and fixed its senders is ready to enforce. Choosing p=reject, sp=reject, rua=mailto:dmarc@example.com, and pct=100 produces: v=DMARC1; p=reject; sp=reject; rua=mailto:dmarc@example.com; pct=100. From publication onward, receivers reject unauthenticated mail claiming to be from the domain, while aggregate reports keep arriving daily so new legitimate sources are spotted before they cause trouble. If a new marketing tool starts sending later, its first messages will appear in the reports as an unauthenticated source, giving the team a chance to add it to SPF or DKIM before customers notice missing mail.
Best Practices and Tips
- Start at p=none and read reports for two weeks before tightening anything.
- Raise pct gradually: 25, then 50, then 100, watching reports at each step.
- Make sure SPF and DKIM pass and align with your domain before enforcing reject.
- Keep the reporting mailbox monitored; unread reports waste the whole system.
- Set sp explicitly if subdomains send mail differently from the main domain.
Common Mistakes to Avoid
- Jumping straight to p=reject before legitimate sources are authenticated.
- Publishing the record at the apex instead of _dmarc.
- Using a reporting address on a domain that has not authorised reports.
- Forgetting subdomains, which inherit the policy whether you thought about them or not.
Frequently Asked Questions
What is DMARC alignment?
It means the domain in the SPF or DKIM check matches the domain in the visible From header. A pass without alignment does not satisfy DMARC.
Why start with p=none?
Because it collects reports without affecting delivery, so you can find every legitimate sender before you start blocking.
Where do I publish the record?
As a TXT record at _dmarc.yourdomain, for example _dmarc.example.com.
Do I need SPF and DKIM first?
Yes, at least one of them must pass and align for a message to pass DMARC.