DMARC Record Creator

Create DMARC records for spoofing prevention, ready to paste into DNS

UpdatesAdded a tool to create DMARC records for spoofing preventionView Updates

Features

Generate by selecting options

Create the hostname and value for DNS pasting on the spot

Display 3-stage deployment steps

Confirm the current configuration stage on screen

Verify guideline requirements

Check if you meet Google and Yahoo! sender requirements

Process only in browser

Your entered domain and addresses are not transmitted

How to Use

Enter domain name

Enter your email sender domain in the input field

Select policy and report destination

Choose a policy from 3 options and enter the aggregate report destination

Adjust advanced settings

Specify application percentage, alignment strictness, and subdomain policy as needed

Copy and register in DNS

Copy the hostname and value, then register as a TXT record

Use Cases

Initial setup for guideline compliance

Create a record with monitoring-only policy and start operations

Gradual policy strengthening

After reviewing reports, upgrade policy to quarantine or reject

Bulk setup for multiple domains

Design and production agencies create separate records for customer domains

Different policy for subdomains

Apply different handling to mail from subdomains only

Knowledge Base

What is DMARC

DMARC is a mechanism that allows domain owners to declare in DNS how to handle emails that impersonate their domain. It uses SPF and DKIM authentication results to tell receiving servers how to handle mail that fails authentication.

SPF：SPF is a mechanism that lists servers authorized to send email for a domain in DNS.
DKIM：DKIM is a mechanism that attaches a digital signature to emails, allowing receivers to verify the signature using the public key in DNS.

Differences between 3 policies

The policy (p tag) instructs receiving servers how to handle mail that fails authentication. There are 3 levels: none (no action), quarantine (move to spam folder), and reject (do not accept).

none：none is the initial stage where you only receive aggregate reports without changing mail handling.
quarantine：quarantine is the stage where you request that mail failing authentication be moved to the spam folder.
reject：reject is the strongest stage where you request that mail failing authentication be rejected before delivery.

Hostname and main tags

DMARC records are registered as TXT records with the hostname that adds _dmarc. before the target domain (example: _dmarc.example.com). The value starts with v=DMARC1 and tags are separated by semicolons.

rua：rua is the tag that specifies the address to receive authentication result aggregate reports, written with mailto: prefix.
pct：pct is the tag that specifies the percentage of mail to apply the policy to, using a value from 1 to 100, with a default of 100.