DMARC Record Generator & Validator
Build a valid DMARC DNS TXT record (_dmarc.<domain>) from the v / p / sp / rua / ruf / fo / adkim / aspf / pct / rf / ri tags (policy none / quarantine / reject, subdomain policy, aggregate & forensic report URIs, failure-reporting options, DKIM & SPF alignment modes, percentage, report format & interval), validate any existing record against RFC 7489, decode every tag with plain-English explanations, validate rua/ruf mailto: syntax, score the policy strength (0–100), generate an enforcement roadmap (none → quarantine → reject), and generate dig / nslookup / kdig (DoH) lookup commands. 100% client-side generation and validation; live lookup requires the network via the generated dig commands.
About DMARC Record Generator & Validator
Build a valid DMARC DNS TXT record (_dmarc.<domain>) from the v / p / sp / rua / ruf / fo / adkim / aspf / pct / rf / ri tags (policy none / quarantine / reject, subdomain policy, aggregate & forensic report URIs, failure-reporting options, DKIM & SPF alignment modes, percentage, report format & interval), validate any existing record against RFC 7489, decode every tag with plain-English explanations, validate rua/ruf mailto: syntax, score the policy strength (0–100), generate an enforcement roadmap (none → quarantine → reject), and generate dig / nslookup / kdig (DoH) lookup commands. 100% client-side generation and validation; live lookup requires the network via the generated dig commands. Everything runs locally in your browser — your data never leaves your device.
How to use
- Enter your input in the tool above.
- Adjust any options to your preference.
- Use the Copy or Download buttons to save the result.
- Everything happens locally — your data never leaves your browser.
FAQ
How does the DMARC generator work?
Pick your domain policy (p=none / quarantine / reject), the subdomain policy (sp=), enter aggregate and forensic report mailto: URIs (rua= / ruf=), choose failure-reporting options (fo=0/1/d/s), DKIM and SPF alignment modes (adkim=r/s, aspf=r/s), the percentage of mail the policy applies to (pct=0–100), and the report format / interval (rf=afrf, ri=seconds). The generator assembles a valid `v=DMARC1; p=...; ...` TXT record for the `_dmarc.<domain>` DNS name with tags in the recommended order, and shows a live preview with a policy-strength meter you can copy. Validation against RFC 7489 runs as you type.
What do p=none / p=quarantine / p=reject mean?
`p=none` is monitoring mode — receivers send aggregate (rua) and forensic (ruf) reports but take NO enforcement action on failing mail. Use this to collect data for 1–2 weeks before enforcing. `p=quarantine` tells receivers to deliver failing mail to the spam/junk folder (recommended intermediate step). `p=reject` tells receivers to REJECT failing mail at the SMTP layer (recommended end-state). Always ramp pct from 10 → 25 → 50 → 100 when moving up a level so you can detect false positives. The tool's enforcement roadmap tells you the exact next step.
What does the validator check?
(1) Valid `v=DMARC1` version tag (must be first). (2) Required `p=` policy tag present and one of none/quarantine/reject. (3) `sp=` subdomain policy is valid. (4) `rua=` / `ruf=` use valid `mailto:` syntax with a valid email address. (5) `fo=` is from {0, 1, d, s}. (6) `adkim=` / `aspf=` are r (relaxed) or s (strict). (7) `pct=` is 0–100. (8) `rf=` is `afrf`. (9) `ri=` is a positive integer (seconds). (10) Tag-order check (v= must be first). (11) Weak-policy warning for `p=none` (monitoring only). (12) Multiple DMARC records flagged (invalid — RFC 7489 §6.1). (13) External-destination verification note for rua/ruf pointing to another domain. (14) Policy-strength score (0–100). Every issue comes with a plain-English explanation and a suggested fix.
What is DKIM / SPF alignment (adkim / aspf)?
DMARC alignment checks that the domain in the DKIM signature (d=) or the SPF return-path matches the domain in the From: header. `adkim=r` (relaxed, default) allows organizational-domain matching — `mail.example.com` aligns with `example.com`. `adkim=s` (strict) requires exact matching — `mail.example.com` does NOT align with `example.com`. `aspf=r` / `aspf=s` work the same for SPF. Strict alignment is safer but breaks legitimate subdomain sending; most domains use relaxed alignment. The tool explains both modes and warns if your alignment is inconsistent with your sending architecture.
What extra features does this tool have compared to other DMARC tools?
(1) Visual generator for v / p / sp / rua / ruf / fo / adkim / aspf / pct / rf / ri tags. (2) RFC 7489 syntax validator with 14+ checks. (3) Per-tag plain-English explanations (`explainTag`). (4) Policy-strength meter (0–100, color-coded). (5) Enforcement roadmap (none → quarantine → reject with pct ramp). (6) rua / ruf mailto: URI validator with external-destination note. (7) DKIM / SPF alignment explainer (r vs s). (8) Failure-reporting options (fo) explainer (0/1/d/s). (9) dig / nslookup / kdig (DoH) / curl DoH lookup commands. (10) Multiple-DMARC-record detector. (11) Policy reference table. (12) Subdomain-policy warning when sp is weaker than p. (13) Copy/download record. (14) localStorage history (max 20, stores only metadata). (15) Shareable URL. 100% client-side.
Related tools
.bashrc / .zshrc Alias & Config Manager
Build shell aliases, functions, exports, and PATH edits in a visual editor, then export a clean, commented .aliases file sourced from both .bashrc and .zshrc — with shadowing detection against shell builtins and common CLI tools, function suggestions when args are needed, starter packs (git, docker, kubectl, navigation, safety, ls, dev, devops, data science), import of existing rc files, dedupe, history (localStorage), and shareable URL. 100% client-side.
Add / Subtract Date Calculator
Add or subtract years, months, weeks, days, hours, minutes and seconds from a starting date/time. Calendar-day or business-day mode with custom weekend + holiday list. Month-end policy toggle (clamp to last day vs overflow). Repeat/series mode (e.g. every 2 weeks x 10) with CSV export. Shareable URL. 100% client-side.
Age Calculator
Calculate exact age from a birth date in calendar years/months/days (no negative-day bugs) plus totals in months/weeks/days/hours/minutes/seconds. Next-birthday countdown with weekday. Feb-29 birthday policy toggle. Milestones (1,000 days, 10,000 days, 1 billion seconds). Zodiac sign + Chinese zodiac. Age gap comparison. Shareable URL. 100% client-side.