Skip to content
Sign inGet started
Help · MoreDMARC record generator: build the record, step by step
Start here

DMARC record generator: build the record, step by step

Choose a policy and a report address, then copy the one TXT record to add at _dmarc on your domain. Built to RFC 9989, the 2026 standard. Free.

On this page · 6 sections
More options
TypeTXTName_dmarc.example.comValuev=DMARC1; p=none
  • • No report address, so receivers send no aggregate reports and you can't see who is sending as your domain. Add one before you tighten the policy.
  • • p=none only watches: mail that fails DMARC is still delivered. It meets Gmail's requirement for bulk senders, and it's the safe first step.

Adding the record

  1. In your DNS provider (on Cloudflare: DNS → Records → Add record), choose type TXT.
  2. For the name, enter _dmarc. Cloudflare and most providers add your domain after it.
  3. Paste the value from the generator and save. Keep exactly one DMARC record: receivers ignore DMARC when they find more than one. [1]
  4. Check it with the email DNS checker.

What each part means

v=DMARC1
What it does: Says this is a DMARC record. It must come first.
If you leave it out: The record is ignored. [1]
p=
What it does: What receivers should do with mail that fails: none (deliver it, just report), quarantine (treat it as suspicious, usually the spam folder) or reject (refuse it).
If you leave it out: Treated as p=none. [1]
sp=
What it does: A different policy for subdomains such as news.example.com.
If you leave it out: Subdomains follow p=. [1]
rua=
What it does: Where receivers send daily aggregate reports, as mailto: addresses.
If you leave it out: No aggregate reports are sent. [1]
ruf=
What it does: Where to send failure reports about single messages.
If you leave it out: No failure reports. [1]
adkim=, aspf=
What it does: How closely the DKIM signing domain and the SPF domain must match the From address: r relaxed or s strict.
If you leave it out: Relaxed. [1]
t=y
What it does: Test mode: tells receivers the policy is still being tested, so they may apply a milder one. Reports are sent as usual.
If you leave it out: t=n, the policy applies in full. [1]

RFC 9989 replaced RFC 7489 in May 2026 and removed the pct= tag. A record with pct= still works, since receivers ignore tags they don't know, but t=y is the new way to test a policy. [1][2]

Going from none to reject

  1. Start with p=none and a rua= address. Gmail asks every sender of 5,000 or more messages a day for a DMARC record, and p=none meets it. [3]
  2. Read the reports for a few weeks. Each service that sends as your domain (your mail host, a newsletter tool, an invoicing app) should pass SPF or DKIM in alignment. Cloudflare's DMARC Management, on all plans with Cloudflare DNS, lists each source sending as your domain for you. [4]
  3. Move to p=quarantine, then p=reject once nothing real fails.

Sending reports to another domain

If the report address is on a different domain, such as a reporting service's, that domain has to agree to receive them. It publishes a TXT record v=DMARC1 at your domain, then ._report._dmarc., then its own, such as example.com._report._dmarc.them.net. Without it, receivers won't send the reports. [5] The generator shows this record when you fill in your domain.

Or let Ayoh add it

When you connect a domain, Ayoh creates a DMARC record if there isn't one, alongside the SPF and DKIM records, in your own Cloudflare account. The records it adds are in SPF, DKIM and DMARC on Cloudflare.

Sources

Read November 1, 2026.

PreviousDKIM checker: find your selector and check the keyNextCatch-all email on Cloudflare: set it up, and when not to