Mailwarm Email Warmup

DMARC Generator

Use this free DMARC generator to create a valid DMARC record for your domain. Pick a policy, add an address for reports, and copy the TXT record into your DNS.

Your DMARC record

TypeTXTHost / Name
_dmarc
Value
v=DMARC1; p=none

Add at least one rua address. Without reports you can't see who sends as your domain, so you can't safely tighten the policy later.

Add this TXT record at your DNS provider, wait for it to propagate, then verify it with the DMARC checker.

DMARC record examples

Three records for the three stages of a DMARC rollout

Monitor only (p=none)

v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

Collects reports and changes nothing about delivery. Where every domain should start.

Quarantine with gradual rollout

v=DMARC1; p=quarantine; pct=25; rua=mailto:dmarc@yourdomain.com

Sends a quarter of failing mail to spam. Raise pct to 100 as your reports stay clean.

Full enforcement (p=reject)

v=DMARC1; p=reject; sp=reject; rua=mailto:dmarc@yourdomain.com; adkim=s

Blocks failing mail on the domain and all subdomains, with strict DKIM alignment.

How to add a DMARC record

Every DNS provider works the same way: a TXT record with the host _dmarc

Cloudflare

Open your domain, go to DNS, then Records, and click Add record. Choose TXT, enter _dmarc as the name, paste the value, and save.

GoDaddy

In your Domain Portfolio, select the domain, open DNS, and add a new record. Choose TXT, set Name to _dmarc, paste the value, and save.

Google Workspace

Google Workspace doesn't host your DNS. Add the TXT record at your domain registrar or DNS provider, then check its status in the Admin console under Apps, Gmail, Authenticate email.

Microsoft 365

For a custom domain, add the TXT record at the DNS provider that hosts your domain, the same place you added the MX and SPF records Microsoft 365 asked for.

Move from p=none to p=reject safely

  1. Publish p=none with a rua address. Leave it for two to four weeks so you see a full sending cycle, including newsletters, invoices and tools you forgot about.
  2. Fix every legitimate sender. Each service in your reports needs SPF or DKIM that passes and aligns with your domain. Verify with the SPF checker and the DKIM checker.
  3. Switch to p=quarantine with a low pct. Start at pct=25 and raise it to 100 while watching your reports and bounce rates.
  4. Move to p=reject. Once quarantine at 100% runs clean, change the policy to reject. Keep reading your reports, because new tools get added over time.

DMARC Generator: Common Questions

Everything you need to create and roll out a DMARC record

Yes, DMARC is free. It is an open standard, and publishing a record only costs a TXT entry in your DNS, which every DNS provider includes. This DMARC generator is free too. The only optional cost is a reporting service to read aggregate reports, which many teams add once their sending volume grows.

DMARC fails when neither SPF nor DKIM passes with a domain that aligns with your From address. The common causes are a service sending as your domain without its own DKIM signature, SPF passing only for the provider's bounce domain, forwarding that breaks SPF, or a DKIM signature from the wrong domain. Your rua reports show which source failed.

DMARC stands for Domain-based Message Authentication, Reporting and Conformance. It builds on SPF and DKIM by checking that at least one of them passes and matches your From domain, tells receivers what to do with mail that fails, and sends you reports about every server that sends email using your domain name.

To set up DMARC, first make sure SPF and DKIM are configured for every service that sends as your domain. Then generate a record with p=none and a rua address, and add it as a TXT record named _dmarc at your DNS provider. Check it with a DMARC checker, read the reports, and tighten the policy over a few weeks.

Start with p=none so you collect reports without affecting delivery. Once the reports show all your legitimate senders passing with alignment, usually after two to four weeks, move to p=quarantine, optionally with a lower pct. When nothing legitimate fails, move to p=reject, which gives the strongest protection against spoofing and is needed for BIMI.

Authentication is step one

DMARC proves who you are. Mailwarm builds the sender reputation that gets your emails into the inbox, with a deliverability audit and an account manager for every customer.

Start Email WarmupView Pricing