Security & Crypto

DMARC Record Generator & Policy Wizard

Generate RFC 7489 DMARC TXT records for your domain. Configure policy enforcement, aggregate XML reporting, and SPF/DKIM alignment modes.

Domain & enforcement policy

Domain name Policy (p tag)

Reporting & alignment

Aggregate report email (rua) Forensic report email (ruf - optional)

Policy percentage (pct: 0-100) Subdomain policy (sp - optional)

SPF Alignment mode (aspf) DKIM Alignment mode (adkim)

Generate your record

Results

What the result means

Construct an RFC 7489 compliant DMARC record to protect your brand domain from phishing, spoofing, and unauthorized impersonation. The wizard facilitates a safe, phased transition by letting you configure policy enforcement levels from monitoring (p=none) to quarantine or strict rejection (p=reject). It sets up daily aggregate XML feedback mailboxes (rua), forensic failure addresses (ruf), percentage rollouts (pct), and relaxed versus strict alignment modes for both SPF and DKIM authentication checks. Once configured, the tool outputs the exact TXT string and subdomain location needed to deploy the record into your authoritative DNS management console.

One DMARC policy record per DNS name

Do not publish two separate DMARC policies at _dmarc.example.com. RFC 9989 says multiple policy records returned for a single target are all discarded. Merge the intended settings into one reviewed policy; do not leave a monitoring record beside an enforcement record.

# Incorrect: two separate TXT records at the same name
_dmarc.example.com TXT "v=DMARC1; p=none"
_dmarc.example.com TXT "v=DMARC1; p=reject"

# Correct structure: one policy, two aggregate-report destinations
_dmarc.example.com TXT "v=DMARC1; p=none; rua=mailto:[email protected],mailto:[email protected]"

The addresses are examples; replace them with monitored destinations. Multiple comma-separated rua destinations are different from multiple policy records. A separate policy at _dmarc.news.example.com is also a different DNS name. Long TXT values can be split into quoted strings within one record; that is not two records.

After editing, query TXT for the exact name with DNS Lookup and confirm there is one DMARC policy. See RFC 9989 policy discovery.

Related tools

Guides

Questions

Can there be multiple DMARC records?

Publish one DMARC policy record per DNS name. Multiple policies returned for the same name are discarded. One policy can list multiple reporting destinations, and separate subdomains can have policies at their own _dmarc names.

What is the recommended rollout order for DMARC policies?

Start at p=none to collect aggregate XML feedback without disrupting delivery. Next escalate to p=quarantine with a partial percentage (e.g. pct=25), and finally to p=reject at 100%.

What is the difference between rua and ruf reporting?

rua receives daily aggregate XML feedback summarizing message volumes and authentication rates. ruf receives real-time individual forensic failure reports containing detailed bounce headers.

Where in DNS should I publish the DMARC record?

Publish the record as a TXT record with host name _dmarc (or _dmarc.example.com if your DNS provider requires fully qualified domain names).