DMARC record checker and generator

Look up the DMARC record for any domain and see what it tells receivers to do with mail that fails authentication.

DMARC record generator

Builds the record. Nothing is sent anywhere; this runs in your browser.

PolicyStart at none. Move up only after reports show your real senders pass.Report address (rua)Where receivers send daily summaries. Use an address on your own domain, or separate several with commas.Subdomain policy (sp)Percentage of mail the policy applies to (pct)Leave at 100 unless you are phasing in quarantine or reject.

Strict alignment (adkim=s, aspf=s). Subdomains will not align with the From domain.

Type

TXT

Host

_dmarc

Value

v=DMARC1; p=none

Publish as a TXT record. Then run the checker above to confirm it is live.

Keep your domain on your radar

A one-time check shows today. Pistos DMARC report monitoring is still being built. Create a free account now to hold your place and add your domain when it opens.

Create a free account

Questions

Where does the DMARC record go?

In a TXT record at _dmarc.yourdomain.com. Most DNS hosts want just "_dmarc" as the name.

Should I start with p=reject?

No. Start with p=none and a reporting address, find every service that sends as you, fix them, then move to quarantine and reject. Going straight to reject can block your own invoices and password resets.

Why does the checker mention a different domain?

If a subdomain has no record, receivers use the record of its organizational domain. We show which one applies.