DMARC Record Generator & Policy Builder: Free DMARC Record Generator & Policy Builder tool: generate and validate DNS DMARC TXT records online. Configure email authentication policies (none.
What is DMARC (Domain-based Message Authentication)?
DMARC (short for Domain-based Message Authentication, Reporting, and Conformance) is an open technical email specification specified in RFC 7489 that gives domain owners the power to protect their domains against unauthorized email use, spoofing, Business Email Compromise (BEC), and phishing impersonation attacks. DMARC builds directly upon two foundational email authentication protocols: SPF (Sender Policy Framework) and DKIM (DomainKeys Identified Mail).
Prior to DMARC, if an incoming email failed SPF or DKIM checks, the recipient mail server had no authoritative instruction on what to do with the fraudulent message. DMARC solves this by allowing domain administrators to publish explicit instructions in DNS indicating whether failed emails should be monitored (none), routed to spam folders (quarantine), or rejected outright at the SMTP gateway (reject).
The Three Progressive DMARC Policy Phases
| Policy Tag | Enforcement Level | Mail Receiver Behavior | Recommended Adoption Stage |
|---|---|---|---|
| p=none | Monitoring Only | Delivers all messages normally while transmitting aggregate RUA XML reports to domain owner. | Stage 1: Discover all third-party senders (Salesforce, Zendesk, Mailchimp) for 30–60 days. |
| p=quarantine | Partial Enforcement | Diverts unauthenticated messages into recipient junk/spam folders. | Stage 2: Mitigate phishing while monitoring legitimate edge delivery. |
| p=reject | Full Enforcement | Permanently rejects unauthenticated emails at SMTP connection time (550 Mail Rejected). | Stage 3: Complete protection against brand spoofing and phishing. |
Understanding DMARC Alignment: Strict vs. Relaxed
A message achieves DMARC Pass if either SPF or DKIM passes AND aligns with the user-visible RFC 5322 From: domain:
- Relaxed Alignment (
adkim=r,aspf=r): Permits organizational subdomains to match the main domain (e.g. mail sent frommail.example.comaligns with aFrom: user@example.comheader). - Strict Alignment (
adkim=s,aspf=s): Mandates that the authenticated DKIM/SPF domain must exactly, character-for-character match the headerFrom:domain.
Mandatory 2024 Google & Yahoo Email Sender Requirements
Beginning February 2024, Google and Yahoo jointly enforced mandatory email authentication requirements for all bulk email senders (transmitting over 5,000 messages daily). Senders must publish a valid DMARC record in DNS, enforce SPF and DKIM authentication, keep spam complaint rates below 0.3%, and provide one-click RFC 8058 unsubscribe headers. Domains lacking DMARC face immediate message throttling and permanent rejections.
Step-by-Step DNS Deployment Guide Across Major Providers
Deploying your generated DMARC TXT record requires updating your authoritative DNS zone:
- Cloudflare: Navigate to DNS > Records. Click 'Add Record'. Select Type:
TXT, Name:_dmarc, Content: paste your generated policy string, TTL: Auto. Ensure Proxy status is DNS-only (gray cloud). - AWS Route 53: Open your Hosted Zone. Click 'Create Record'. Record name:
_dmarc, Record type:TXT, Value: enclose the value inside double quotes ("v=DMARC1; p=reject; ..."), TTL: 300 seconds. - Google Cloud DNS: In Cloud DNS zones, add record set
_dmarc.yourdomain.com.with Resource Record TypeTXTand TXT Data formatted with standard quotation framing.
Interpreting DMARC XML Aggregate Reports (RUA)
Once your DMARC record is published with an active rua= tag, recipient mail servers (Google, Microsoft, Yahoo) will bundle daily XML reports. These reports reveal the IP addresses of every mail server transmitting messages on behalf of your domain, the volume of messages sent, SPF evaluation results, and DKIM cryptographic signature verification outcomes. Analyzing these reports guarantees that you discover all legitimate shadow IT senders before transitioning to strict rejection.