SecVaultAuditor
PL
Free generator, no sign-up

DMARC record generator

Choose what receivers should do with forged messages and where to send reports. You get a ready TXT record to paste into your DNS panel and an explanation of each tag.

What to do with fakes (p=)
Advanced settings

We build the record from your choices. We store nothing and do not query the domain's DNS.

How to roll out DMARC without losing mail

  1. Start with p=none and a rua address. Nothing is blocked, and receivers start sending reports.
  2. Read the reports for 2-4 weeks: every service that sends on your behalf (email, shop, invoices, newsletter) must pass SPF or DKIM.
  3. Set p=quarantine. Fakes go to spam. For a more careful start, add the testing flag t=y.
  4. Finally p=reject: forged mail "from your company" does not reach customers at all.

A DMARC record only makes sense together with working SPF or DKIM. A missing DMARC record is a critical issue in our audit, because anyone can then send an invoice "from you".