DMARC Record Generator

What is a DMARC record generator?

A DMARC record generator is a tool that builds the exact TXT record you publish at _dmarc.yourdomain.com so mailbox providers know what to do with mail claiming to be from your domain. Instead of memorizing tag syntax, you fill in a few fields and the DMARC record generator assembles a correctly ordered, valid value for you.

DMARC stands for Domain-based Message Authentication, Reporting and Conformance. It builds on two separate checks that mail servers already run on incoming messages, and it adds an instruction for what should happen when those checks fail, plus a way to get reports back. If you send review requests, invoices, appointment confirmations, or any business email from your own domain, this one entry is what tells Gmail, Outlook, and every other major provider whether to trust it.

The output is not decorative. Get one character wrong, and providers either ignore it entirely or apply a rule you did not intend. That is the actual value of running things through a generator instead of typing the string by hand: it keeps the tag order sensible, wraps report addresses correctly, and stops you from publishing something stricter than you meant to before you have ever looked at a report.

How do you use the DMARC record generator?

Using the tool above takes a few minutes. Fill in your domain and reporting address, review the plain-English summary, then copy the value into your DNS host. Here is the full sequence.

1. Open the DMARC record generator on this page and type your sending domain, for example example.com, without http:// or www in front of it.
2. Choose how strict the record should be. If this is your first time, leave the main setting at none. This tells providers to check your mail and report on it, without rejecting or quarantining anything yet.
3. Add an aggregate report address (rua). This is the mailbox that receives a daily summary of who is sending mail as your domain, and whether each source passed the underlying checks.
4. Decide whether you need a forensic report address (ruf). Most businesses skip this, since many large providers do not send forensic reports at all, but it is there if you want it.
5. Set alignment and rollout options if you have a reason to. Most domains are fine leaving both alignment settings relaxed, the percentage at 100, and the report interval at the default.
6. Read the summary under the generated value. It tells you in plain language what the setting will actually do to your mail.
7. Copy the value, or download it as a .txt file, then log in to your DNS host (Cloudflare, GoDaddy, Namecheap, or wherever your domain's DNS is managed) and publish it as a new entry at the host shown, typically _dmarc.yourdomain.com.

After publishing, changes propagate on their own schedule, up to the TTL you set (3600 seconds, or one hour, is a sensible default). You can check it took effect with any DNS lookup tool once that window has passed. Google Workspace's own setup guide documents the same underlying steps, if you want a second reference alongside this one.

Why does DMARC matter for a local business?

DMARC matters because it decides whether the email you depend on actually reaches your customers, and whether someone else can send fraudulent mail that looks like it came from you. For a local business, both sides of that show up in ordinary, everyday tasks.

Think about the emails a small business actually sends. A review request after a service call. An appointment confirmation for tomorrow's job. A receipt or an invoice. None of that is exotic marketing mail, but all of it depends on the receiving server trusting your domain. Without anything published at your domain's mail-security entry, a growing share of that mail quietly lands in spam, especially once a provider updates its filtering. Customers do not chase down a missing invoice in their spam folder; they just assume you never sent one.

Now flip it around. A domain with nothing published there is easier to spoof. Someone can send a fake invoice or a fake "your appointment needs rescheduling" message that appears to come from your business, aimed at your own customers or your suppliers. Even a monitoring-only setting gives you visibility into that: the aggregate reports show every server that claims to send mail as your domain, which is often the first sign that spoofing is happening.

This also connects to how your business shows up on Google Maps and in local search. If you are running review request campaigns to build up your Google Business Profile, and a meaningful share of those emails never reach the inbox, you are losing reviews you already earned. Fixing deliverability is unglamorous, but it is a direct input into the review volume and response rate that a local ranking tool is tracking on the map side.

Understanding the DMARC record tags

Each field in the generator maps to a tag in the final value you publish. Knowing what each one controls means you can read an entry someone else published and understand exactly what it does, not just trust that it looks right.

v and p (version and policy)

v=DMARC1 marks the entry as valid and must be the first tag. p is the instruction for what happens to mail from your domain that fails the underlying checks: none simply monitors and delivers everything as normal, quarantine routes it to spam, and reject blocks it before it reaches an inbox at all. Every valid entry needs a p tag, and it is the one setting that changes outcomes the most.

rua and ruf (reporting addresses)

rua=mailto:[email protected] sets where aggregate reports go: a daily summary listing every sending source seen for your domain and whether each one passed. This is how you find out a marketing platform or a helpdesk tool is sending on your behalf before you accidentally block it. ruf=mailto:[email protected] asks for message-level failure samples, but plenty of large mailbox providers do not implement that part of the specification, so treat it as a bonus, not a dependable stream.

adkim and aspf (alignment)

Alignment is the piece that actually ties everything together. The sending check and the signing check can each pass against a domain that is technically related to yours but not an exact match, for example a subdomain used by a mail platform. Relaxed mode (r) accepts that kind of related match. Strict mode (s) requires the domain to match exactly. Most domains run fine on relaxed for both settings; strict is for cases where you want zero tolerance for near-matches.

pct and sp (rollout controls)

pct lets you apply the stricter setting to only a slice of your mail, for example pct=25 while you watch how it behaves before committing fully. sp sets a separate rule for subdomains, which matters if mail.yourdomain.com or a marketing subdomain should be treated differently than your primary sending domain. Leaving sp unset means subdomains simply inherit whatever the main setting is.

Best practices and common mistakes

• Start at the none setting and actually read the aggregate reports for a few weeks before changing anything. Reports tell you what will break before you break it.
• Never jump straight to reject. Move from none to quarantine, watch the reports again, then move to reject once you recognize every sending source in them.
• Set up your sending and signing checks before you publish anything stricter than none. The entry only checks the results of those two systems; without them configured, your own legitimate mail can fail.
• Keep exactly one entry at _dmarc.yourdomain.com. Two entries at the same host is invalid, and most receivers will disregard both.
• Watch for a stray second entry left behind by a previous provider, a migration, or a marketing tool that auto-added its own value. This is one of the most common reasons a record that looks correct still does not behave as expected.
• Recheck the entry after any change of email provider, since a new platform may need to be added to your list of authorized senders.

When should you publish a DMARC record?

There is rarely a bad time to publish one at the none setting, but a few situations make it genuinely urgent.

Launching a new domain is the easiest moment, because you have no legacy mail flows to untangle. Publish the entry on day one alongside your other DNS records, and you start collecting visibility from the very first message you send.

Moving to a new email provider is the next common trigger. Migrations are exactly when senders get missed, forwarding rules get left behind, or a second entry accidentally appears at the same host. A fresh check against the reports catches that quickly.

After any spoofing incident, whether a customer forwarded you a fake invoice or a supplier reported a phishing attempt using your domain, publishing or tightening the setting is a direct response, and the reports will often show you where the fraudulent mail originated.

Before a large review request campaign, it is worth confirming your entry and reporting address are in good shape. A wave of outbound email is exactly when deliverability problems become visible, and by then it is too late to fix quietly.

Frequently asked questions

Do I need anything else configured first?

Yes. Get your sending and signing checks working first, since the entry only checks the results of those two systems. Publishing a stricter setting without them in place makes your own legitimate mail more likely to fail, not less.

Will publishing this record slow down or block my email?

Not at the none setting. That option only asks for reports and changes nothing about delivery. Mail only gets routed to spam or blocked once you move to quarantine or reject, which is exactly why the recommended path is to monitor first.

How long does it take for a new entry to work?

DNS changes propagate up to the TTL you set on the entry, commonly one hour at 3600 seconds. Some resolvers cache slightly longer. Give it a few hours, then verify with any DNS lookup tool before assuming it did not take.

What is the difference between the two reporting addresses?

rua reports are daily aggregate summaries, listing every source sending as your domain and its results. ruf reports would show individual failing messages, but most major mailbox providers do not send them, so rua is the reporting stream you should actually rely on.

Can I use one entry for all my subdomains?

Yes, by default subdomains inherit the main setting if you leave sp unset. Only add an sp value if a specific subdomain, such as one used by a separate marketing tool, genuinely needs a different rule than your primary sending domain.

Is a free DMARC record generator accurate enough for a real business domain?

Yes. A well-built DMARC record generator only formats the tags into a valid value, there is no proprietary logic to get wrong. What actually requires ongoing attention is reading your reports and adjusting the setting over time, not the syntax of the entry itself. The dmarc.org project publishes the underlying specification if you want to verify anything the generator produces.

Trustworthy email is part of the same reputation that shows up when customers search for you on Google Maps. Once your review request and appointment emails are actually reaching inboxes, you can track whether that translates into ranking movement, more reviews, and more calls with ProMapRanker, and start free with 150 credits to run your first scan today.

Related tools

A DMARC record generator handles one piece of a domain's technical setup. These free tools cover other pieces you are likely to need next.

• Robots.txt generator for controlling what search engines can crawl.
• .htaccess redirect generator for Apache-hosted domains that need clean redirects.
• Nginx redirect generator for the same job on an Nginx server.
• WWW to HTTPS redirect generator to make sure your domain resolves consistently to one secure address.
• Favicon and meta tag generator for the basic head tags every page should have.