DMARC record generator
Choose a policy and where reports should go. You get the TXT record for _dmarc on your domain, ready to copy, with every tag explained in plain words.
Your DMARC record
Fill in your domain and choose a policy, then select Generate record. The TXT record appears here, ready to copy.
What DMARC does
DMARC tells receiving mail servers what to do when an email claims to be from your domain but fails both SPF and DKIM for it, and where to send reports about it.
An email passes DMARC when SPF or DKIM passes and the domain it passed for matches the domain in the From address. That match is called alignment. Relaxed alignment, the default, also accepts a subdomain.
The policy decides what happens to mail that fails:
- p=none
- Deliver as usual and send reports. The safe way to start.
- p=quarantine
- Treat failing mail as suspicious, usually the spam folder.
- p=reject
- Refuse failing mail. The strongest protection against people spoofing your domain.
Publish it in four steps
1.Check SPF and DKIM first
DMARC only passes when SPF or DKIM passes for your domain. Set those up with your email provider before you tighten the policy.
2.Add the TXT record
In your DNS host, add a TXT record with host _dmarc and the value above. Replace any old DMARC record instead of adding a second one.
3.Wait, then check it
DNS changes usually show up within minutes, sometimes a few hours, depending on your DNS host. Then run the free SPF, DKIM and DMARC checker on your domain.
4.Read the reports, then tighten
Aggregate reports show every server sending as your domain. When all of your own mail passes, move from none to quarantine, then reject.
DMARC in Inboxed
Inboxed checks SPF, DKIM, DMARC and MX for each connected mailbox’s domain on a schedule and shows the record to add when one is missing. You can upload DMARC aggregate reports to see which servers send as your domain and how many messages pass or fail each day. See the deliverability suite. Inboxed charges only for emails that send, with no plan or seats; see pricing.
Sources
- RFC 9989: DMARC (May 2026; obsoletes RFC 7489 and RFC 9091; tags, t=y, removal of pct), read 10 November 2026.
- RFC 7489: DMARC (defaults, pct sampling, external report addresses, §6.3, §6.6.4, §7.1), read 10 November 2026.
- Google: Email sender guidelines (DMARC for bulk senders), read 8 November 2026.
Questions
Where do I add the DMARC record?
In the DNS settings of the domain in your From address, as a TXT record. The host (or name) is _dmarc. Some DNS hosts want the full name, such as _dmarc.yourcompany.com. Keep exactly one DMARC record: with two, receivers ignore both.
Which policy should I start with?
p=none with a rua address. It changes nothing about delivery and gets you daily reports. When the reports show your own mail passing SPF or DKIM, move to p=quarantine, then p=reject.
Do Gmail and Yahoo require DMARC?
Yes, for bulk senders. Google’s sender guidelines ask senders of more than 5,000 messages a day to Gmail to publish DMARC, and p=none is accepted. A record also helps smaller senders, because it gives you reports.
What happened to pct?
RFC 9989 (May 2026) obsoletes RFC 7489, the old DMARC standard, and RFC 9091, and removed pct. It added t=y, test mode, which asks receivers to apply your policy one level lower. Receivers still on the older standard may read pct, so the generator still offers it, but leave it at 100 unless you have a reason.
Relaxed or strict alignment?
Relaxed (the default) for almost everyone. It lets mail signed or sent from a subdomain, such as mail.yourcompany.com, count for yourcompany.com. Strict needs an exact match and can fail mail from tools that use a subdomain.
Is anything I type sent to Inboxed?
No. The record is built in your browser. Nothing is sent or saved, and the tool costs nothing to use.
Warm up today. Launch when you’re ready. Pay only for emails that send.
No subscription and no card to start. Warmup and verification are free; emails cost $1 per 1,000 as they send.