DMARC Record Generator
Generate a correct DMARC TXT record with policy, reporting address, percentage and alignment options, with rollout guidance.
Last reviewed by the Radiatus Cloud team
Rollout path: start with p=none + rua reporting, review reports for a few weeks, then move to quarantine and finally reject. DMARC requires SPF and/or DKIM to be set up first.
Need this handled by experts?
Radiatus runs VAPT, managed SOC & security engineering for regulated teams.
Generate a correct DMARC record
DMARC protects your domain from being spoofed in email, but its TXT record has a specific syntax that is easy to get wrong. This generator builds a correct DMARC record from your chosen policy, reporting address, percentage and alignment, ready to add to your DNS.
Why the policy choice matters
A DMARC record tells receiving servers what to do with mail that fails authentication: do nothing (monitor), quarantine it, or reject it outright. The safe path is to start in monitor mode with reports enabled, learn who is really sending your mail, and only then tighten to quarantine and reject once you are confident legitimate mail passes. Moving to reject too early can block your own mail; staying in monitor forever leaves spoofers unblocked. The generator builds the record for whichever stage you are at, with the reporting address so you get the data to progress.
The right record for your stage
The tool runs entirely in your browser, so nothing you paste is uploaded, which is exactly what you want when the input is your own security-sensitive data.
Related tools
- Password Strength Checker — Measure password strength by entropy and pattern analysis rather than character-class rules. Checked entirely in your browser.
- Password Generator — Generate strong random passwords and passphrases in your browser using the Web Crypto API. Nothing is transmitted, logged or stored.
- Hash Generator — Generate MD5, SHA-1, SHA-256 and SHA-512 hashes in your browser. Compare checksums and verify file integrity with nothing uploaded to a server.
- Base64 Encoder/Decoder — Encode and decode Base64 in your browser, including URL-safe Base64 and UTF-8 text. Handles files and data URIs locally with nothing uploaded.
Frequently Asked Questions
What does a DMARC record do?
It tells receiving mail servers what to do with mail failing authentication, monitor, quarantine or reject, and where to send reports about it.
Which policy should I start with?
Monitor mode with reports enabled, so you learn who sends your mail without blocking anything, then tighten to quarantine and reject once confident.
Why not start at reject?
Because if any legitimate sender is not yet authenticating, reject blocks your own mail. Start in monitor, fix senders, then tighten safely.
What is the reporting address for?
It receives the aggregate reports showing who is sending mail as your domain, which is the data you need to tune the setup and detect spoofing.
Is my input uploaded?
No. The generation runs entirely in your browser.
Privacy & Security
Runs entirely in your browser. No data is sent to any server.
How to Use
Enter your domain, choose a policy (start with p=none) and a report address, then copy the record value into a _dmarc TXT record in DNS.
Disclaimer: This tool is provided "as is" without warranty of any kind. Results are for educational and utility purposes.
Related Tools
Password Strength Checker
SecurityMeasure password strength by entropy and pattern analysis rather than character-class rules. Checked entirely in your browser.
Password Generator
SecurityGenerate strong random passwords and passphrases in your browser using the Web Crypto API. Nothing is transmitted, logged or stored.
Hash Generator
SecurityGenerate MD5, SHA-1, SHA-256 and SHA-512 hashes in your browser. Compare checksums and verify file integrity with nothing uploaded to a server.