DMARC generator

A DMARC generator turns a few choices into the TXT value you publish at _dmarc on your domain. The form on this page runs entirely in the browser. The domain, the mailbox, and the policy you pick are not sent to tlspeek and are not stored. When you are ready, you copy the record into the DNS host that serves the domain. Publishing it is a change you make at that host, not a change this site can make for you.

The record always starts with v=DMARC1. p is required and is one of none, quarantine, or reject. Add sp only when subdomains should differ from the organizational domain. Add pct only when you are deliberately applying a stricter policy to part of your mail. Omit pct to cover every message, which is the default of 100. rua should be a mailbox you control. If you type an address without mailto:, the generator adds that scheme. ruf is optional and usually left blank. adkim and aspf default to relaxed when you leave them unset, which is what most domains want until they have a reason to be strict.

A rollout that does not break mail

Publish p=none with a rua address first. For a week or two, read the aggregate reports and list every service that sends mail as you: the company mailbox, the support desk, the newsletter tool, the invoice system. Each of those has to pass SPF or DKIM in alignment with the From domain. Fix the ones that do not. Then publish p=quarantine, still with rua, and watch for legitimate mail landing in spam. When that is quiet, publish p=reject. Skipping ahead is how password resets and receipts vanish.

pct can make the same climb in smaller steps. pct=10 with p=quarantine asks receivers to quarantine about a tenth of failing mail. Raise it as the reports stay clean, and remove it when you reach full coverage. pct=0 looks like a policy and applies to nothing, so the generator warns about it. Do not leave a partial percentage in DNS and assume the policy is finished.

Where the record goes

The host name is _dmarc followed by the domain, for example _dmarc.example.com. The type is TXT. The value is the single line the form builds. Publish one TXT record at that name. A second DMARC record, even a leftover from an earlier edit, makes both of them invalid. SPF stays on the bare domain. DKIM stays on a selector under _domainkey. DMARC does not replace either of those. It refers to them.

Choices that surprise people

• p=none with no rua collects nothing and stops nothing. If you are not ready to enforce, you still want the reports.
• A rua mailbox on a different domain needs an authorization record at that other domain. Otherwise the reports are discarded and the policy looks silent.
• Strict alignment (adkim=s or aspf=s) fails mail that a subdomain signed or sent. Leave both relaxed unless every sender uses the exact From domain.
• sp=reject while p=none is a valid combination, and it is harsher on subdomains than on the domain people notice. Set sp on purpose.
• The generator can build a record that is stricter than your mail is ready for. The warnings under the record are there so you can loosen it before you publish.

After the record is live, use the DMARC checker to read it back from public DNS. DNS hosts differ on how fast a new TXT record is visible. A few minutes is common, and an hour is not unusual. The checker is a separate lookup. The generator itself never performs one.