--- title: "Generate a DMARC record" description: "Build a DMARC record: pick a policy, a subdomain policy and a report address, then copy the value and publish it as a TXT record at _dmarc on your domain." url: https://www.unitpost.com/tools/dmarc-generator section: Free tools updated: 2026-11-02 --- # Generate a DMARC record A DMARC record is one TXT record at _dmarc.yourdomain, such as v=DMARC1; p=none; rua=mailto:dmarc@yourdomain. Choose a policy (none to monitor, quarantine to send failing mail to spam, reject to refuse it), a policy for subdomains, the share of failing mail it covers, the alignment mode and an address for aggregate reports. Start at p=none with a report address, and tighten once reports show every legitimate sender passing. > Interactive tool: https://www.unitpost.com/tools/dmarc-generator. The record is built in your browser. Nothing you type is sent to Unitpost, and there's no sign-up. ## What each choice does > Each field sets one tag in the record. A field left at its default writes no tag, because receivers assume the default anyway. | Field | Tag | What it does | | --- | --- | --- | | Policy | `p` | What receivers do with mail that fails DMARC: none delivers it and reports, quarantine sends it to spam, reject refuses it. | | Subdomains | `sp` | The policy for subdomains without a record of their own. Written only when it differs from the domain's policy. | | Apply to this % of failing mail | `pct` | Applies the policy to a share of failing mail and treats the rest one step softer. Written only below 100. RFC 9989 removed this tag, so leave it at 100 unless you have a reason. | | Alignment | `adkim`, `aspf` | Relaxed passes when SPF or DKIM is for the same organizational domain as From, so `mail.example.com` aligns with `example.com`. Strict needs the exact domain. Written only for strict. | | Send aggregate reports to | `rua` | Where receivers send their aggregate reports of who sent mail as your domain and whether it passed. `mailto:` is added for you. | Pick relaxed alignment unless you know every sender uses your exact domain. Strict SPF alignment fails for any service that uses a return-path subdomain, Unitpost's `unitpost.` included; DKIM still aligns there, because the signature uses your domain. ## A safe record to start with > Start with monitoring and a report address. This record changes nothing about delivery and meets the minimum Gmail, Yahoo and Microsoft set for bulk senders: **TXT at _dmarc.example.com** ```bash v=DMARC1; p=none; rua=mailto:dmarc@example.com ``` When the reports show every legitimate source passing, publish `v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com`, and later `p=reject`. The order and what to look for are in rolling out DMARC (/tools/dmarc-checker#rollout). If you send through Unitpost, the domain page suggests `v=DMARC1; p=none;`; add a `rua` address to that to get reports. ## Where to publish it > Add one TXT record named `_dmarc` on the domain in your From address, so it resolves at `_dmarc.example.com`. - Name or host: `_dmarc`. Most DNS editors add the domain for you; typing `_dmarc.example.com` there creates `_dmarc.example.com.example.com`. - Type: TXT. Value: the generated record. If your editor adds quotes itself, don't add your own. - One record only. A second `v=DMARC1` record at the same name makes receivers apply no policy at all. - Subdomains are covered by this record unless they publish their own. Then confirm what DNS serves, or run the DMARC checker (/tools/dmarc-checker): ```bash dig TXT _dmarc.example.com +short ``` ## FAQ ### What should my first DMARC record be? `v=DMARC1; p=none; rua=mailto:dmarc@yourdomain`. It changes nothing about delivery and starts the reports you need before you enforce a policy. ### Is p=none enough for Gmail and Yahoo? For their bulk sender requirement, yes: both accept `p=none` as the minimum. It doesn't stop anyone from spoofing your domain; quarantine and reject do. ### What address should I use for rua? A mailbox that can take a steady flow of XML attachments, or a DMARC report service. An address on another domain only receives reports if that domain authorizes it. ### Should I use strict or relaxed alignment? Relaxed, in almost every case. Strict fails mail sent through services that use a return-path subdomain or sign for a parent domain, and adds little protection. ### How long does a DMARC record take to work? Receivers use it once their DNS caches pick it up, usually within the record's TTL. Aggregate reports usually cover a full day, so the first ones arrive a day or two later. ## Related - [Analyze email headers](https://www.unitpost.com/tools/email-header-analyzer): Paste a message's headers to see its SPF, DKIM and DMARC results, alignment, unsubscribe headers and the delay at each hop. Nothing leaves your browser. - [SMTP reply and status codes](https://www.unitpost.com/tools/smtp-codes): Look up an SMTP reply such as 550 5.7.26 or 421 4.7.0: what the basic and enhanced codes mean, whether to retry, and what to fix. - [SMS character and segment calculator](https://www.unitpost.com/tools/sms-segment-calculator): Count SMS characters and segments as you type: see GSM-7 or UCS-2 encoding, which characters force UCS-2, and the cost per message by country.