How to create a DMARC record

DMARC gives domain owners a way to tell receiving mail systems how to handle messages that fail aligned SPF and DKIM checks. It also defines where aggregate reports should go. The first record should usually help you observe mail rather than block it.

Use the free DMARC record generator to select the common settings and copy a DNS-ready TXT value.

Quick answer

Create a DMARC record as a TXT record at _dmarc.yourdomain.com. Start with v=DMARC1; p=none, add an aggregate-report address with rua, then monitor legitimate sending sources before moving to quarantine or reject.

DMARC does not replace SPF or DKIM. It relies on at least one of them passing with domain alignment.

Choose a cautious starting policy

DMARC policies are:

• p=none: request reports without asking receivers to quarantine or reject failing messages.
• p=quarantine: ask receivers to treat failing messages as suspicious.
• p=reject: ask receivers to reject failing messages.

Start with p=none while you identify every legitimate mail source, including transactional mail, support platforms, billing systems, newsletters, and any tools that send as your domain. Moving too quickly can affect legitimate messages that are not configured correctly.

Build the record

The smallest useful record starts with:

v=DMARC1; p=none

Most teams also add an aggregate-report destination:

v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com

Use an inbox or reporting service that can receive and process those reports. Do not point rua to an address you do not control.

Publish it in DNS

1. Open the DNS provider for the sending domain.
2. Create a TXT record.
3. Set the host or name to _dmarc. Many DNS providers add your domain automatically.
4. Paste the generated value as the TXT content.
5. Save the record, then verify the published value after DNS changes take effect.

Your provider may display the name as _dmarc.example.com; that is the same location when the managed zone is example.com.

Understand alignment

DMARC checks whether the visible From domain aligns with a passing SPF or DKIM identity. Relaxed alignment allows related subdomains in common cases. Strict alignment requires an exact domain match.

Relaxed alignment is a common starting point. Tightening alignment without understanding every mail stream can cause legitimate messages to fail DMARC, so make that change only after reviewing reports.

What to do before tightening policy

Before moving from monitoring to quarantine or reject:

1. Confirm that every legitimate sender passes SPF or DKIM.
2. Confirm that the authenticated domain aligns with the visible From domain.
3. Review aggregate reports for several reporting cycles.
4. Move gradually, using the pct value only when a quarantine or reject policy is active.
5. Keep checking after each policy change.

You can use the SPF checker to review your published SPF configuration, then generate a new DKIM record if a sending provider needs a dedicated key.

Frequently asked questions

Where does a DMARC record go?

Publish it as a TXT record at _dmarc.yourdomain.com.

Should I start with p=reject?

Usually no. Begin with monitoring so you can find legitimate senders before a stricter policy can affect their delivery.

Does DMARC guarantee that spoofed mail is blocked?

No. DMARC expresses a policy to receiving systems. Their final treatment can also depend on local policy and message context.