DMARC record generator and checker
Create a policy record and inspect an existing record's syntax.
Your inputs
Your results
Ready when you areYour results will appear here.
How it works
Generate a DMARC draft, inspect pasted TXT values, or look up _dmarc at your exact sending domain. Policies request handling of messages that fail DMARC; alignment links an authenticated SPF or DKIM domain to the From domain. Sources: https://knowledge.workspace.google.com/admin/security/set-up-dmarc, https://www.rfc-editor.org/rfc/rfc7489 and current https://www.rfc-editor.org/rfc/rfc9989.html.
Read the source reference ↗A few things to know
Practical generator and common-tag checker, not a complete RFC validator or mail authentication test. Only exact-host TXT lookup; no parent-domain discovery, SPF/DKIM signature verification, external report authorization checks, report mailbox checks or DNS publishing. Percentage is legacy compatibility and is not a safe limit on enforcement. Receiver behavior and inbox placement are not guaranteed. Live lookup uses Google Public DNS with a six-second timeout; generate and paste modes make no requests.
When to use this tool
A DMARC record expresses a requested handling policy and optional reporting destination for mail using your domain. This tool can generate a draft, inspect pasted values or look up the exact domain’s published TXT records. It explains common tags and flags basic problems while keeping the limits visible. Generating a record does not publish DNS, verify your sending services or establish that legitimate mail is ready for enforcement.
- Prepare a monitoring-policy draft for DNS review.
- Inspect a pasted DMARC record’s common tags and duplicate values.
- Look up the exact _dmarc hostname while checking a deployment.
How to use dmarc record generator and checker
Choose the mode and domain
Select Generate a draft, Check pasted record or Look up live DNS. Enter the sending domain. Live mode queries Google Public DNS; generate and paste modes process locally.
Set or inspect the policy details
For a draft, choose the requested policy, optional aggregate report email and SPF/DKIM alignment modes. The legacy percentage field is compatibility text, not a reliable enforcement cap. For paste mode, supply the TXT values.
Review before publishing
Inspect the generated host, tags and diagnostics. Confirm your sending inventory, alignment and report handling outside this tool. Publish any approved change through your DNS provider, then use live mode to inspect the exact hostname.
Generate a monitoring draft
Inputs
Use example.com, policy none, aggregate report email dmarc@example.com, legacy percentage 100 and relaxed DKIM/SPF alignment.
Result
The draft host is _dmarc.example.com. The value is v=DMARC1; p=none; rua=mailto:dmarc@example.com; pct=100; adkim=r; aspf=r. Basic checks pass, with a warning that pct is legacy compatibility.
What it means
The draft requests monitoring rather than enforcement. It has not been published, and the report mailbox is not checked. Current DMARC removes pct, so do not rely on the included legacy tag to limit receiver enforcement.
Common mistakes to avoid
Enforcing before understanding senders
An enforcement policy can affect legitimate messages that fail alignment. Use your sending inventory and reports to investigate those sources before changing policy.
Treating pct as a safety switch
The current DMARC specification removes this legacy tag. Newer receivers may ignore it, so a percentage is not a dependable limit on enforcement.
Assuming an exact-host lookup finds every effective policy
This tool queries _dmarc at the entered domain only. It does not perform parent-domain policy discovery, so an empty result does not resolve every policy question for a subdomain.
Frequently asked questions
Definitions, edge cases, and practical next steps for this tool. Search all tool FAQs ↗
What do none, quarantine and reject mean?
They express requested handling for messages that fail DMARC. None is useful for monitoring, while quarantine and reject request more restrictive treatment. Receiver behavior is not guaranteed, and this generator does not decide which policy is appropriate for your domain’s legitimate senders.
What is DMARC alignment?
Alignment connects an authenticated SPF or DKIM domain with the visible From domain. Passing a mechanism for some other domain is not enough by itself. This tool explains and configures alignment tags but does not evaluate a message’s actual authentication or domain relationship.
What is the difference between relaxed and strict alignment?
The draft offers r for relaxed and s for strict for both mechanisms. Strict alignment requires a closer domain match; relaxed alignment permits the applicable organizational-domain relationship. Verify how your actual providers sign and send before changing these settings.
Why does the tool warn about the percentage tag?
The percentage field writes legacy RFC 7489 compatibility text. Current RFC 9989 removes pct, and receivers using newer behavior can ignore it. The warning prevents interpreting a generated percentage as a dependable partial-enforcement guarantee.
Does entering a report email make reports arrive?
No. The generator writes a mailto reporting URI but does not verify the mailbox, recipient configuration or external reporting authorization. Confirm those requirements with your reporting service and DNS configuration. Successful syntax checks do not establish that reporting is operational.
Where should the record be published?
The tool displays _dmarc followed by your domain as the full hostname. DNS control panels may instead expect _dmarc within that domain’s zone. Follow your provider’s field conventions and avoid accidentally appending the domain twice. This tool makes no DNS changes.
Does live lookup check parent-domain inheritance?
No. It queries the exact _dmarc hostname for the entered sending domain. It does not perform the complete policy-discovery process. Investigate applicable parent-domain policy separately when evaluating a subdomain rather than interpreting no exact record as no effective policy.
What does Passed basic checks establish?
It means the supported common-tag checks found no basic problem in that value. It does not prove complete RFC conformance, report authorization, SPF/DKIM readiness or delivery. Review the diagnostics and use aggregate reports and actual-message tests before treating the domain as configured correctly.
Explore the topic in the blog
Sources and method
Use the references below to check definitions and platform guidance. The model’s scope and limits are explained above. Read our editorial standards.