TXT record name
ToolsDMARC record generator
DMARC record generator: wikipedia.org
TXT record value
Pick quarantine or reject only once your reports show every legitimate sender passes SPF or DKIM. Blocking too early sends real mail (invoices, accounting software, website notifications…) to spam or bounces it.
The report domain needs a record too
Your report address is on another domain, so that domain must agree to receive reports for you. Without this record many receivers won’t send the reports. DMARC report services usually add it for you.
A safe path to enforcement
- Start with p=none and a report address (rua). Mail keeps flowing as usual.
- Watch the reports for 2–4 weeks. Fix SPF and DKIM for every legitimate sender that still fails.
- Once legitimate mail passes, move to p=quarantine (pct lets you apply it gradually).
- When things are stable, move to p=reject to block spoofed mail outright.
Build a DMARC record for your mail domain
DMARC tells receivers what to do with mail that fakes your domain, and sends you reports on who is sending as you. This tool builds the record in your browser.
Which policy should I start with?
Start with p=none and a report address. Mail keeps flowing; read the reports for 2–4 weeks before moving to quarantine and then reject.
Do I need SPF and DKIM first?
Yes, ideally. DMARC passes only when mail passes SPF or DKIM for your domain. If you have neither, use the SPF record generator and DKIM generator first.
Can reports go to an address on another domain?
Yes, but that domain needs an extra TXT record agreeing to receive them. The tool shows that record when it is needed.