What this tool does
Builds the DMARC TXT record string to publish in DNS, from a domain, policy level, percentage, and report address. It only generates the record; it does not change DNS.
How to use it
- Enter the domain.
- Choose the policy: none to monitor, quarantine to isolate, reject to block.
- Set the percentage — start low and raise it as reports come in.
- Enter the address that should receive aggregate reports.
- Publish the generated string as a TXT record on the _dmarc host.
Worked example
Domain example.com with policy none at 100% produces the TXT value to publish at _dmarc.example.com. Adding a report address includes the rua tag.
Frequently asked questions
- Can I start at reject?
- Not advisable. If any legitimate sending path lacks aligned SPF or DKIM, real mail gets rejected. Run none for a few weeks, confirm every sending path from the reports, then raise the policy.
- Can reports go to a different domain?
- Yes, but that domain must publish an authorisation record of its own, or the reports will not be delivered.
What this tool does not cover
It produces valid syntax, but publishing the record and aligning your sending paths is your work. After publishing, verify with the DMARC checker.