Available at https://www.suped.com/tools/dmarc-record-generator.
Build a valid DMARC record using a guided form. The generator walks you through each option and outputs a complete TXT record you can add to _dmarc.yourdomain.com.
The generator supports record options from the updated DMARC specification (RFC 9989), including np, psd, and t. Support for these tags varies between receiving mail servers.
Options
Policy (p)
The action receivers should take when authentication fails: none (monitor only), quarantine (send to spam), or reject (block the email).
Aggregate reports (rua)
Email addresses that receive daily DMARC aggregate reports in XML format. These reports show who is sending email using your domain.
Failure reports (ruf)
Email addresses that receive individual failure reports. These provide details about specific authentication failures. Less commonly supported by receivers.
Alignment modes (adkim, aspf)
Controls how strictly the domains in DKIM and SPF must match the From header domain:
- Relaxed (default) - organizational domain match (e.g.
mail.example.commatchesexample.com) - Strict - exact domain match only
Failure options (fo)
When to request failure reports, if a ruf destination is configured:
0- Generate when neither SPF nor DKIM produces an aligned pass (default)1- Generate when either SPF or DKIM fails to produce an aligned passd- Generate when DKIM failss- Generate when SPF fails
Subdomain policy (sp)
Set the policy for existing subdomains of your organizational domain. If omitted, they inherit the main policy. Non-existent subdomains also use this policy unless you set np.
Non-existent subdomain policy (np)
Choose none, quarantine, or reject for messages using non-existent subdomains of your organizational domain. If omitted, this inherits sp, or p if sp is not set. Non-existent means DNS returns NXDOMAIN, not simply that a subdomain has no DMARC record.
Public suffix domain (psd)
An advanced domain-discovery setting: y identifies a public suffix domain; n identifies a domain that is not a public suffix and is the organizational domain for itself and its subdomains. u (the default when omitted) leaves organizational-domain discovery to the receiver. Do not select y unless you operate a public suffix domain.
Testing mode (t)
y requests testing mode: reject is treated as quarantine, and quarantine as none. This applies to the policy selected from p, sp, or np; none and reporting are unchanged. Omitted or n requests normal policy enforcement. Older receivers may ignore this tag and apply the published policy, so testing mode does not guarantee that failing messages will be delivered.
Deprecated tags
The updated DMARC specification (RFC 9989) removes pct (policy sampling percentage), ri (requested aggregate reporting interval), and rf (failure report format). Receivers following it ignore these legacy tags. Leave the Percentage and Reporting interval fields empty to omit them, and avoid adding rf to new records. Do not rely on pct for gradual rollout or ri to control when reports arrive. See the recommended DMARC rollout path.
Output
The generator produces a complete TXT record value that you add as a DNS record at _dmarc.yourdomain.com. Copy the output and paste it into your DNS provider.
