How does the DMARC generator work?

Pick your domain policy (p=none / quarantine / reject), the subdomain policy (sp=), enter aggregate and forensic report mailto: URIs (rua= / ruf=), choose failure-reporting options (fo=0/1/d/s), DKIM and SPF alignment modes (adkim=r/s, aspf=r/s), the percentage of mail the policy applies to (pct=0–100), and the report format / interval (rf=afrf, ri=seconds). The generator assembles a valid `v=DMARC1; p=...; ...` TXT record for the `_dmarc. ` DNS name with tags in the recommended order, and shows a live preview with a policy-strength meter you can copy. Validation against RFC 7489 runs as you type.

What does the validator check?

(1) Valid `v=DMARC1` version tag (must be first). (2) Required `p=` policy tag present and one of none/quarantine/reject. (3) `sp=` subdomain policy is valid. (4) `rua=` / `ruf=` use valid `mailto:` syntax with a valid email address. (5) `fo=` is from {0, 1, d, s}. (6) `adkim=` / `aspf=` are r (relaxed) or s (strict). (7) `pct=` is 0–100. (8) `rf=` is `afrf`. (9) `ri=` is a positive integer (seconds). (10) Tag-order check (v= must be first). (11) Weak-policy warning for `p=none` (monitoring only). (12) Multiple DMARC records flagged (invalid — RFC 7489 §6.1). (13) External-destination verification note for rua/ruf pointing to another domain. (14) Policy-strength score (0–100). Every issue comes with a plain-English explanation and a suggested fix.

What is DKIM / SPF alignment (adkim / aspf)?

DMARC alignment checks that the domain in the DKIM signature (d=) or the SPF return-path matches the domain in the From: header. `adkim=r` (relaxed, default) allows organizational-domain matching — `mail.example.com` aligns with `example.com`. `adkim=s` (strict) requires exact matching — `mail.example.com` does NOT align with `example.com`. `aspf=r` / `aspf=s` work the same for SPF. Strict alignment is safer but breaks legitimate subdomain sending; most domains use relaxed alignment. The tool explains both modes and warns if your alignment is inconsistent with your sending architecture.

What extra features does this tool have compared to other DMARC tools?

(1) Visual generator for v / p / sp / rua / ruf / fo / adkim / aspf / pct / rf / ri tags. (2) RFC 7489 syntax validator with 14+ checks. (3) Per-tag plain-English explanations (`explainTag`). (4) Policy-strength meter (0–100, color-coded). (5) Enforcement roadmap (none → quarantine → reject with pct ramp). (6) rua / ruf mailto: URI validator with external-destination note. (7) DKIM / SPF alignment explainer (r vs s). (8) Failure-reporting options (fo) explainer (0/1/d/s). (9) dig / nslookup / kdig (DoH) / curl DoH lookup commands. (10) Multiple-DMARC-record detector. (11) Policy reference table. (12) Subdomain-policy warning when sp is weaker than p. (13) Copy/download record. (14) localStorage history (max 20, stores only metadata). (15) Shareable URL. 100% client-side.

Developer Runs in your browser

DMARC Record Generator & Validator

Build a valid DMARC DNS TXT record (_dmarc.<domain>) from the v / p / sp / rua / ruf / fo / adkim / aspf / pct / rf / ri tags (policy none / quarantine / reject, subdomain policy, aggregate & forensic report URIs, failure-reporting options, DKIM & SPF alignment modes, percentage, report format & interval), validate any existing record against RFC 7489, decode every tag with plain-English explanations, validate rua/ruf mailto: syntax, score the policy strength (0–100), generate an enforcement roadmap (none → quarantine → reject), and generate dig / nslookup / kdig (DoH) lookup commands. 100% client-side generation and validation; live lookup requires the network via the generated dig commands.

100% Private Works Offline Instant

DMARC Record Builder

Domain

DNS name: _dmarc.example.com

Policy (p=) — required

Policy for the organizational domain. `none` = monitor only (no enforcement). `quarantine` = deliver failing mail to spam. `reject` = reject failing mail at SMTP. Always ramp pct from 10 → 100 when moving up.

Subdomain policy (sp=) — optional

Aggregate report URI (rua=) — optional

Comma-separated for multiple. Aggregate reports are XML summaries — used for monitoring.

Forensic report URI (ruf=) — optional

Forensic reports may leak PII and are suppressed by Gmail/Yahoo. Rely on rua= for monitoring.

Failure reporting options (fo=) — optional

0 = both fail. 1 = either fails. d = DKIM failed. s = SPF failed. Ignored without ruf=.

DKIM alignment (adkim=)

SPF alignment (aspf=)

Percentage (pct=) — 0–100

Report interval (ri=) — seconds

Generated Record

v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com

Policy strength0/100 — none

Length

54 chars

Policy

none

rua

yes

Valid

Yes

Enforcement roadmap

The recommended path to maximum enforcement. Your current position is highlighted.

Step 0Monitor (p=none)current

Collect 1–2 weeks of rua reports. Identify all legitimate senders (Mailchimp, Google, your own MTAs, etc.).

Step 1Quarantine ramp (p=quarantine, pct=10 → 100)

Start at pct=10. Review rua reports for false positives. Ramp pct to 25 → 50 → 100 over 1–2 weeks.

Step 2Quarantine full (p=quarantine, pct=100)

All failing mail is delivered to spam. Monitor for 1 week before moving to reject.

Step 3Reject ramp (p=reject, pct=10 → 100)

Start at pct=10. Receivers now reject failing mail at SMTP. Ramp pct to 25 → 50 → 100 over 1–2 weeks.

Step 4Maximum enforcement (p=reject, pct=100)

Full enforcement. Continue monitoring rua reports; rotate DKIM keys annually; review senders quarterly.

Verify with dig

Run these in your terminal to look up the published DMARC record for _dmarc.example.com.

digdig TXT +short

dig +short TXT _dmarc.example.com

List the TXT record(s) on _dmarc.example.com. Look for the one starting with "v=DMARC1".

digdig TXT (filtered for DMARC)

dig +short TXT _dmarc.example.com | grep '^"v=DMARC1'

Filter dig output to show only DMARC records. Multiple lines = multiple DMARC records (invalid).

digdig TXT (full)

dig +noall +answer TXT _dmarc.example.com

Show the full TXT answer section with TTL.

digdig @resolver TXT

dig +short TXT _dmarc.example.com @1.1.1.1

Query Cloudflare DNS (1.1.1.1) directly — useful for cached-vs-authoritative comparison.

kdigkdig (DNS-over-HTTPS)

kdig +https @1.1.1.1 TXT _dmarc.example.com

DNS-over-HTTPS lookup via Cloudflare. Bypasses local DNS / firewall inspection.

nslookupnslookup TXT

nslookup -type=TXT _dmarc.example.com

Cross-platform TXT lookup (Windows-friendly).

curlDoH via curl (Cloudflare)

curl -s 'https://cloudflare-dns.com/dns-query?name=_dmarc.example.com&type=TXT' -H 'accept: application/dns-json' | jq '.Answer'

Fetch the TXT records as JSON via DNS-over-HTTPS. Pipe through jq for pretty output.

hosthost TXT

host -t TXT _dmarc.example.com

Quick TXT lookup via the `host` utility (BIND).

Tag reference

v=Versionrequired

DMARC version. MUST be the first tag and the value MUST be exactly `DMARC1` (case-insensitive). Identifies the TXT record as a DMARC record.

p=Policyrequired

sp=Subdomain policy

Policy for subdomains. Defaults to the value of `p=` (inherit). Set explicitly when subdomains need a different policy (e.g. p=reject but sp=none for parked subdomains).

Default: inherits from p=

rua=Aggregate report URI

Comma-separated list of `mailto:` URIs that receive daily aggregate (rua) reports. Aggregate reports are XML summaries of all mail claiming to be from your domain — used for monitoring. Receiver MUST be authorized via a DMARC record at the report-receiver's domain (`example.com._report._dmarc.reportreceiver.com`).

ruf=Forensic report URI

Comma-separated list of `mailto:` URIs that receive forensic (ruf) reports — copies of failing messages with headers. Controlled by the `fo=` tag. Forensic reports may leak PII and are increasingly suppressed by receivers (Gmail, Yahoo); rely on rua for monitoring.

fo=Failure reporting options

Colon-separated failure-reporting options for the ruf= destinations. `0` (default) = report if both SPF and DKIM fail. `1` = report if either fails. `d` = report if DKIM failed. `s` = report if SPF failed. Ignored if ruf= is absent.

Default: 0

adkim=DKIM alignment

DKIM identifier-alignment mode. `r` (relaxed, default) allows organizational-domain matching — `mail.example.com` aligns with `example.com`. `s` (strict) requires exact matching. Strict is safer but breaks legitimate subdomain sending.

Default: r

aspf=SPF alignment

SPF identifier-alignment mode. `r` (relaxed, default) allows organizational-domain matching. `s` (strict) requires exact matching. Same semantics as adkim=.

Default: r

pct=Percentage

Percentage of mail the policy applies to (0–100). `pct=100` = full enforcement. Use lower values to ramp up safely — e.g. start at `pct=10` when moving from none → quarantine, then ramp to 100.

Default: 100

rf=Report format

Report format for rua/ruf reports. Only defined value is `afrf` (Authentication Failure Reporting Format, RFC 6591).

Default: afrf

ri=Report interval

Requested interval between aggregate reports, in seconds. Default is 86400 (24 hours). Receivers may use a longer interval at their discretion.

Default: 86400

Policies

p=noneMonitor only0/100

Receivers send aggregate (rua) and forensic (ruf) reports but take NO enforcement action on failing mail. Use this to collect data for 1–2 weeks before enforcing.

p=quarantineSpam folder50/100

Receivers deliver failing mail to the spam/junk folder. Recommended intermediate step before full reject.

p=rejectReject at SMTP100/100

Receivers reject failing mail at the SMTP layer (mail never reaches the inbox). Recommended end-state for domains with verified legitimate senders.

fo= options

fo=0Both fail (default)

Generate a forensic (ruf) report only if BOTH SPF and DKIM fail to align. Default behavior.

fo=1Either fails

Generate a forensic report if EITHER SPF OR DKIM fails to align. More reports, more noise.

fo=dDKIM failed

Generate a forensic report if DKIM failed to verify (regardless of SPF).

fo=sSPF failed

Generate a forensic report if SPF failed (regardless of DKIM).

Privacy: All generation and validation runs locally. History stores only operation metadata (action + policy + strength + ts), never the record, domain, or report URIs. Live lookup requires the network via the dig commands above.

How to use

Enter your input in the tool above.
Adjust any options to your preference.
Use the Copy or Download buttons to save the result.
Everything happens locally — your data never leaves your browser.

All tools