Build a valid DMARC TXT record in seconds.
Pick a policy (start with none to monitor), set the aggregate-report address, hit copy — paste the result into your DNS provider as a TXT record under _dmarc.yourdomain.com. No signup, nothing leaves your browser.
_dmarc.yourdomain.com
v=DMARC1; p=none
In your DNS provider, add a TXT record with the hostname above and the value above. Allow up to 24h for DNS propagation, then verify with our DMARC checker.
The generator will happily emit p=reject. Do not publish that first. Start at p=none with a rua address you actually read, spend two to four weeks identifying every legitimate sender on your domain, then ramp.
Going straight to reject is the classic mistake, and it is discovered by way of a marketing CRM nobody remembered that stops delivering.
As a TXT record on the subdomain _dmarc.yourdomain.com. The value is the full string starting with "v=DMARC1;".
p=none. It collects reports without affecting delivery so you can identify legitimate senders before tightening the policy.
No. Always set rua (aggregate). ruf (forensic) is rarely useful — most providers don't send forensic reports, and the ones that do can leak recipient data.
p=none is safe — it doesn't change delivery, only collects reports. Only escalate once your reports show every legitimate sender passing SPF or DKIM alignment.
Use our free DMARC checker after publishing. It reads the record at _dmarc.yourdomain.com and confirms the policy + pct are what you expect.
SieveGuard's Domain Health add-on tracks SPF, DKIM, DMARC + MX on every domain you ingest, with drift alerts when something changes. Free during your trial.