DMARC Record Generator: build the TXT record for your domain (free)
Gmail and Yahoo require DMARC from bulk senders, but writing “v=DMARC1; p=none; …” by hand is easy to get wrong. Pick a policy and a report address here and you get one line you can paste straight into DNS. If you already have a record, load it and tighten it from there.
The part after @ in your From address. “Load current record” looks up the DMARC record in DNS and fills in the options below. Nothing you enter is stored.
Google, Yahoo, Microsoft and others send daily XML reports here. Separate several addresses with commas. Reports can be numerous, so a dedicated mailbox works best.
Advanced options (usually fine as they are)
With relaxed alignment, mail signed by news.example.com also passes for example.com. Keep it relaxed if you send through an email service.
Add this to your DNS
_dmarc
v=DMARC1; p=none
In your DNS provider (Cloudflare, GoDaddy, Namecheap, Route 53 and so on), add a record of type TXT. If the host field adds your domain automatically, enter just “_dmarc”. Changes can take a few minutes to a few hours.
Without a report address, monitor-only mode tells you nothing. Add an address to receive reports.
Get practical newsletter tips by email
Law changes, subject line and sending tips, and new free tools — a few emails a month.
How to roll out DMARC
- Set up SPF and DKIM first. DMARC passes mail that passes one of them with a domain that matches your From address.
- Generate a record with “Monitor only” (p=none) and a report address, and add it to DNS as a TXT record at _dmarc.
- Read the reports for a few days to two weeks and check that every legitimate sender passes: your own mail, your email service, invoicing and support tools. Our DMARC report reader helps.
- Then move to quarantine, optionally with pct=25 at first, and finally to reject for the strongest protection against spoofing.
What each tag means
- v=DMARC1: marks the record as DMARC. It must come first.
- p: what to do with failing mail: none, quarantine (spam) or reject.
- rua: where daily aggregate reports go, written as mailto: addresses.
- sp: the policy for subdomains. If omitted, p applies.
- pct: the share of failing mail the policy applies to (1–100). Defaults to 100.
- adkim and aspf: relaxed (r) or strict (s) domain alignment for DKIM and SPF. Default is relaxed.
Questions
- Is p=none enough? It meets the Gmail and Yahoo bulk sender requirement, but it does not stop spoofing. Tighten once your reports look clean.
- Can I have two DMARC records? No. With two TXT records at _dmarc, receivers treat the domain as having no DMARC. Edit the existing record instead.
- Can reports go to another domain? Yes, but that domain must publish a TXT record authorizing it. Enter an address at another domain and the tool shows the record you need.
- Do you store what I enter? No. The record is built in your browser. Only “Load current record” sends the domain, to look it up in DNS.
Send your newsletter with aligned DKIM
When you send from your own domain with Newsletter Ready, mail is DKIM-signed with your domain, so it keeps arriving after you move DMARC to quarantine or reject. The DNS records you need are shown in the app, and AI drafts each newsletter from your website.
Mention this tool on your blog or in a guide
If you'd like to link to this tool, paste the HTML below. No need to ask first.
<a href="https://newsletterready.com/tools/dmarc-record-generator">DMARC Record Generator: build the TXT record for your domain (free) (free)</a>
Sources
- RFC 7489: Domain-based Message Authentication, Reporting, and Conformance (DMARC)
- Google: Email sender guidelines
- Google Workspace Admin Help: Set up DMARC
- Yahoo Sender Hub: Sender requirements
This tool builds a typical record. Tightening the policy can stop mail from any sender you have not set up. Check your DNS provider's and email services' instructions as well.