Domain Audit HQ
← Back to Free Tools
GOOGLE & YAHOO 2024+ MANDATE READY • 100% FREE

Free DMARC Policy Generator & Syntax Builder

Construct compliant DMARC records to instruct receiving mail servers how to treat unauthenticated emails and safeguard your brand against phishing.

DMARC Policy Builder

Domain-based Message Authentication, Reporting, and Conformance (DMARC) protects your brand by preventing domain spoofing. Customize your enforcement policy and reporting targets.

Generated DMARC TXT Record

v=DMARC1; p=none
DNS configuration tip: Publish this as a TXT record under the hostname _dmarc.example.com.

How DMARC Works & DNS Mechanics (RFC 7489)

DMARC provides a critical feedback loop and policy enforcement mechanism between email senders and receivers. It ties together the SPF envelope authentication and cryptographic DKIM signatures to ensure that the sender address visible in the "From:" header matches the verified domain.

Core DMARC Directives

  • v=DMARC1: Required version tag identifying the record.
  • p=reject|quarantine|none: Mandatory policy enforcement applied to failed messages.
  • rua=mailto:...: Destination email for aggregated daily XML authentication telemetry.
  • ruf=mailto:...: Destination for real-time forensic failure failure reports.
  • pct=100: Percentage of email messages subject to the filtering policy.
  • aspf / adkim: Strict (s) or relaxed (r) domain identifier alignment.

The 3-Stage DMARC Rollout Strategy

  • Stage 1 (p=none): Collect XML telemetry for 2-4 weeks to discover all legitimate senders.
  • Stage 2 (p=quarantine): Divert unauthenticated messages to recipient spam folders.
  • Stage 3 (p=reject): Permanently drop unauthenticated spoofing attempts at the mail gateway.

Step-by-Step Deployment Guide: Publishing Your DMARC Record

Cloudflare

Navigate to DNS > Records → Click Add record → Type: TXT → Name: _dmarc → Content: Paste your generated DMARC record → TTL: Auto → Save.

AWS Route 53

In Hosted Zones → Choose your domain → Create record → Record name: _dmarc → Type: TXT → Value: "v=DMARC1; p=quarantine; rua=mailto:..." → TTL: 3600 → Create records.

GoDaddy / Namecheap

Open DNS Zone File → Add Record → Record Type: TXT → Host: _dmarc → TXT Value: Paste generated record → TTL: 1 Hour → Save.

Common DMARC Errors & Troubleshooting Real-World Failures

1. Premature p=reject Causing Legitimate Email Drops

Cause: Setting p=reject before ensuring all third-party email tools (HubSpot, Salesforce, Zendesk, accounting software) have properly signed DKIM keys.

Fix: Roll back policy to p=none or p=quarantine; pct=20 while you complete sender discovery via aggregate reports.

2. DMARC Published at Root Domain (@) Rather Than _dmarc Subdomain

Cause: Entering @ or leaving the hostname field empty when creating the DNS TXT record. Mailbox providers only query _dmarc.domain.com.

Fix: Update the record name to _dmarc in your DNS manager.

Frequently Asked Questions About DMARC

Detailed answers on policy progression, inbox enforcement, and deliverability guarantees.

What is DMARC and how does it protect client domains?+
DMARC (Domain-based Message Authentication, Reporting, and Conformance, RFC 7489) builds on SPF and DKIM. It allows domain owners to publish policy instructions telling receiving mail servers (Gmail, Microsoft, Yahoo) how to handle emails that fail SPF or DKIM alignment, and sends back XML aggregate telemetry reports.
What is the difference between p=none, p=quarantine, and p=reject?+
p=none is monitoring mode (receivers deliver messages normally while sending reports); p=quarantine banishes failed messages to the recipient spam or junk folder; p=reject commands the receiving server to drop fraudulent emails at the gateway, preventing them from ever reaching mailboxes.
Why do Google and Yahoo require DMARC for bulk email senders?+
Since February 2024, Google and Yahoo enforce mandatory DMARC records for any organization sending more than 5,000 daily emails. Senders lacking a valid DMARC record face delivery throttling, rejection codes, and mandatory spam placement.
What is the purpose of the rua= mailto tag in a DMARC record?+
The rua tag specifies the email address where receiving mail servers send daily XML aggregate reports detailing sending IP addresses, pass/fail authentication rates, and potential spoofing attempts.
Where should I publish the DMARC TXT record in DNS?+
The DMARC record must be published as a TXT record with host name "_dmarc" at the root domain level (e.g. "_dmarc.yourdomain.com"). Publishing it at the root "@" will not be recognized by receiving mail servers.

Complementary Domain & Email Authentication Tools

Strengthen your client email infrastructure and DNS security perimeter with our free web tools.

🛡️

SPF Record Generator

Generate RFC 7208 compliant SPF TXT records with instant syntax validation.

Open Tool →
🧮

SPF Lookup Calculator & Flattener

Audit the 10-lookup limit and recursively inspect nested include: mechanisms.

Open Tool →
🎨

BIMI Checker & VMC Validator

Audit BIMI records, preview SVG logos, and check VMC certificate readiness.

Open Tool →
🔑

DKIM Record Builder

Format cryptographic public key TXT records and selectors for email signing.

Open Tool →