Free forever
DMARC RecordGenerator
Create a DMARC policy for your domain. Configure enforcement, reporting, and subdomain policies. DMARC decides what receivers do when SPF and DKIM fail, and where the reports about it are sent.
14-day free trial · no credit card · cancel anytime
DMARC Policy (p=)
Subdomain Policy (sp=) — optional
This free DMARC record generator builds the TXT record you publish in DNS: the policy receivers apply when authentication fails (p=none, p=quarantine or p=reject), the address that receives aggregate reports (rua), and optional tags like the subdomain policy (sp=) and rollout percentage (pct=). Configure the options above and copy the result. No account, no email required.
DMARC ties SPF and DKIM to the domain people actually see in the From header. Without it, anyone can send mail that claims to be your domain, and mailbox providers have no instruction on what to do about it. Gmail, Yahoo and Microsoft now expect bulk senders to publish at least a monitoring policy, so a missing record hurts deliverability even if you are never spoofed.
A generator matters because most broken DMARC records are typos: a missing v=DMARC1 tag, a malformed mailto: in rua, or a record published at the wrong host. The generator produces valid syntax every time; your only decisions are the policy and where reports go.
How it works
- 01Enter the domain you send mail from, the one that appears after the @ in your From address.
- 02Choose a policy. Start with p=none to collect reports without affecting delivery, then move to quarantine and reject once the reports show only legitimate mail passing.
- 03Add the mailbox that should receive aggregate reports in the rua field. Reports arrive as XML, roughly once a day per receiver.
- 04Copy the generated value and publish it as a TXT record at the host _dmarc.yourdomain.com in your DNS provider.
- 05Confirm the record resolves, with a DNS lookup or the free email health check, and watch the first reports arrive within a day or two.
When to use it
Use the generator when you set up a new sending domain, when a deliverability audit flags a missing or invalid DMARC record, or when Gmail and Yahoo bulk-sender requirements ask for one. It also covers policy changes: regenerate the record when you are ready to move from monitoring to quarantine or reject rather than hand-editing the live value.
If you already have a record and mail is failing, generate a clean p=none version first. A conservative valid record beats a strict broken one, and the reports will tell you exactly which senders would break under enforcement.
Common mistakes
Publishing the record at the wrong host
The record belongs at _dmarc.yourdomain.com, not at the domain root. Published anywhere else it simply does not exist to receivers, and every DMARC checker will report the domain as unprotected.
Jumping straight to p=reject
Reject with no monitoring period silently drops legitimate mail from senders you forgot about, like a CRM, invoicing tool or newsletter service that never got aligned. Run p=none for a few weeks and read the reports first.
Publishing two DMARC records
Some DNS providers happily store a second TXT record at _dmarc. Receivers that find more than one treat DMARC as absent, so the domain loses protection precisely when you think you doubled it.
Sending reports to an unprepared inbox
Aggregate reports are zipped XML files that arrive daily from every large receiver. Point rua at a dedicated address or a report-processing service, not a founder inbox.
Forgetting subdomains
Without an sp= tag, subdomains inherit your main policy. That is often right, but if a subdomain sends mail through a different provider, verify its SPF and DKIM before you enforce, or set sp= explicitly.
Frequently asked questions
Is this DMARC record generator really free?
Yes. The generator is free, needs no account, and has no usage limit. LitInboxes makes money on continuous monitoring, which re-checks your records every 6 hours, not on one-off DNS tools.
Where do I publish the generated DMARC record?
Create a TXT record at the host _dmarc followed by your domain, for example _dmarc.example.com, and paste the generated value starting with v=DMARC1. In most DNS dashboards you enter only _dmarc in the name field.
How do I verify my DMARC record is live?
Query the TXT record for _dmarc.yourdomain.com with dig or nslookup, or run the free email health check on this site. Most DNS changes propagate within minutes, though some providers take up to an hour.
Can I generate a DMARC record for a subdomain?
Yes. Enter the subdomain as the domain and publish the record at _dmarc.sub.example.com. Alternatively, publish one record on the organizational domain and control subdomain behavior with the sp= tag.
What does the pct= tag do?
It applies your quarantine or reject policy to only a percentage of failing mail, which lets you ramp enforcement gradually. It has no effect at p=none, and receivers eventually expect you to reach pct=100.
Can aggregate reports go to an address on a different domain?
Yes, but the receiving domain must consent by publishing a verification TXT record named yourdomain.com._report._dmarc on itself. Without it, most receivers refuse to send reports across domains.
Will publishing a DMARC record break my email?
Not at p=none, which only turns on reporting and changes nothing about delivery. Quarantine and reject affect only mail that fails both SPF and DKIM alignment, which is exactly the mail you want acted on once your own senders pass.
From the blog
- 550 5.7.515 in Outlook: What It Means and How to Fix It?Outlook.com bounced the email because the From domain failed a trust check. The May 2025 rule, the 5,000-a-day line, and the DNS fix.
- Why Does My Email Fail DMARC When SPF Passes?SPF checked the domain your platform mailed from, not the domain in your From line. That mismatch, not a broken record, is the usual reason DMARC fails.
Related free tools
These tools answer the question once. Continuous monitoring re-checks your domain every 6 hours and alerts you when the answer changes, from $14/mo. Pricing · Guides · FAQ
This answers once. Monitoring answers every 6 hours.
LitInboxes re-checks DNS, DMARC, and blocklists on a schedule and emails you when the answer changes. Start with a 14-day free trial.
14-day free trial · no credit card · cancel anytime