DMARC record generator

What the DMARC generator does

Fill in a few fields and get a valid record for _dmarc.yourdomain.com: the policy, a subdomain policy, the report addresses and the alignment modes. The record starts with v=DMARC1, which RFC 9989 requires as the first tag.

It also suggests the rollout path, so you know which record to publish now and which ones come next.

The rollout path

Most domains should climb the ladder in steps:

• Start at p=none with rua set, and collect reports.
• After two to four weeks of reports with every real sender passing, move to p=quarantine.
• When quarantine has run clean for a few weeks, switch to p=reject.

To try a stricter policy before it fully applies, publish it with t=y. Receivers then apply one level below, so reject with t=y acts as quarantine. Remove t=y once the reports stay clean. Older guides use pct for this step, but RFC 9989 retired pct in May 2026.

Each step only affects mail that fails. If the reports show a sender failing, fix its SPF or DKIM before you tighten. A forgotten billing tool or CRM is the usual culprit.

How to publish

Create a TXT record with the host _dmarc. Some DNS panels want only _dmarc, others want _dmarc.yourdomain.com. Paste the value, save, and confirm it with the DMARC checker.

Keep one DMARC record per domain. A subdomain can have its own record at _dmarc.sub.yourdomain.com, which receivers use instead of the parent's.

Why it matters for cold email

Every sending domain needs its own DMARC record. A record on your main domain covers its subdomains, but not sibling domains like getyourbrand.com. Bulk senders to Gmail, Yahoo and Outlook.com need at least p=none.

Outbound domains that send through one provider can roll out fast. Once the reports show that provider passing DKIM with your domain, move to quarantine or reject.