DMARC Record Checker & Generator
Check whether your domain already has a DMARC record, then build the right policy for where you are in the journey. Start with monitoring, gain visibility, and tighten enforcement as you go.
No enforcement. Use this to collect data first.
Daily or weekly XML reports from receivers
Per message failure reports (high volume)
- 1 Log in to your domain registrar or DNS host such as Cloudflare, Namecheap, GoDaddy, or AWS Route53.
- 2 Open the DNS settings or Zone Editor for your domain.
- 3 Add a new TXT record with name or host:
_dmarc - 4 Paste the generated DMARC value into the Value or Content field.
- 5 Set TTL to 3600 (1 hour) or 300 (5 minutes) for testing.
- 6 Save the record and wait up to 48 hours for DNS propagation. Most updates take effect within 5 to 30 minutes.
- 7 Verify with:
dig TXT _dmarc.yourdomain.com - 8 Start with p=none, study reports for 1 to 2 weeks, then move to p=quarantine, and finally p=reject.
Why Email Authentication Determines Your Deliverability
Email authentication is the foundation of deliverability. Without a DMARC record, your domain is open to spoofing and phishing, because receivers have no policy telling them what to do with unauthenticated mail. Bad actors can send messages that appear to come from you, which erodes the reputation you have built with recipients and mailbox providers alike.
Gmail and Yahoo now require DMARC for bulk senders. If you send more than five thousand messages a day, mail that fails authentication can be rejected or sent to spam. Even smaller senders gain better inbox placement and fewer bounces when a clear policy is published, because receivers trust domains that take responsibility for their mail.
A DMARC record also gives you visibility into who sends mail for your domain. Aggregate reports, delivered to your RUA address, show which services authenticate cleanly and which need attention. Over time you move from monitoring to enforcement, protecting your domain reputation at every stage without guessing.
How to Deploy DMARC Without Breaking Deliverability
Start by entering your domain to check for an existing record. If none exists, use the generator below to create one. If you are new to DMARC, begin with p=none so you collect data without changing delivery. Add your RUA email to receive aggregate reports from the major mailbox providers, which show every source that sends mail from your domain and whether it passes.
Once you have a couple of weeks of reports, strengthen the policy to p=quarantine. This tells receivers to send unauthenticated mail to spam. Confirm that real mail is unaffected, then move to p=reject for full protection. Use the advanced options to tune alignment and reporting intervals for your setup.
Copy the generated TXT record and add it to your DNS host for _dmarc.yourdomain.com. Use the dig command from the setup guide to confirm propagation. Review your aggregate reports each week so any new unauthorized sender shows up before it becomes a problem.