Email infrastructure / DNS record builder

DMARC Generator

Build a DMARC record against RFC 9989/9990/9991 (DMARCbis, published May 2026). Check live DNS evidence first, then generate a policy with an evidence-aware view of what could go wrong if you do — or do not — change it.

01

Check what's currently published

Enter the domain people receive email from. This queries _dmarc.yourdomain.com and the root domain's SPF via Cloudflare's public DNS-over-HTTPS resolver.

02

Set your policy

Each control maps to a DMARC tag. Defaults are omitted where the protocol provides a default, keeping the generated record shorter and easier to audit.

Risk: none gives visibility but does not enforce against failing mail. Quarantine and reject increase protection, but can affect legitimate traffic that is not correctly aligned.
Risk: only override inheritance when you understand which subdomains actually send mail and which should never send.
Risk: an explicit np policy can make your intended treatment of non-existent subdomains clearer. Do not add it blindly; check your domain/subdomain model first.
Risk: testing mode is useful for staging, but leaving it enabled means your selected enforcement is not being applied at its full level.
Risk: strict alignment can break third-party sending if the signing domain does not exactly match the From domain.
Risk: strict SPF alignment can increase integration risk with vendors and forwarding paths. Verify before enforcing.
Why it matters: aggregate reports are your evidence loop for discovering legitimate senders and authentication failures. Without rua, you are making enforcement decisions with much less visibility.
Risk: forensic reporting can raise privacy and operational concerns and is not uniformly supported. Use it only when there is a specific need.
▸ Advanced tags (fo, psd) — most domains don't need these
03

Your DNS record

Publish this as a TXT record. The preview updates as you change settings.

v=DMARC1; p=none
Type: TXTHost / Name: _dmarcTTL: 3600 (or provider default)
04

Risk & action intelligence

Evidence first, interpretation second. This decision aid reports signals from the live check and selected settings and explicitly marks what is still unknown.

ASSESSING

What to do

    What not to do

      05

      How to Create, Check, and Enforce a DMARC Record

      Use these three practical workflows to generate a DMARC record, check your existing DNS configuration, and move from monitoring toward enforcement safely.

      STEP 01

      How to Generate a DMARC Record

      Enter your root organizational domain, choose the appropriate DMARC policy, configure the reporting and alignment options you need, then generate the TXT record for _dmarc.

      STEP 02

      How to Check Your Existing DMARC Record

      Check the live DMARC TXT record and review its policy, reporting, and alignment settings. Also verify which legitimate services are authorized to send mail for your domain before making changes.

      STEP 03

      How to Move from p=none to Enforcement Safely

      Start by collecting and reviewing DMARC reports, fix SPF or DKIM authentication and alignment problems, then consider p=quarantine before moving to p=reject when legitimate mail is consistently authenticated.

      Important: A syntactically valid record is not proof that every legitimate sender is aligned. Treat production DNS changes as controlled changes and validate them against real sending behavior.