DMARC Record Generator

DMARC (Domain-based Message Authentication, Reporting, and Conformance) is an email authentication protocol that builds on top of SPF and DKIM. It gives domain owners a way to tell receiving mail servers what to do when an email fails authentication checks — and provides a reporting mechanism so you can see exactly what's happening with mail sent from your domain.

The real power of DMARC is visibility. Before DMARC, you had no way to know if someone was spoofing your domain. With aggregate reports enabled, you get daily summaries from email providers showing every IP address that attempted to send mail as your domain, along with the authentication results. This makes it straightforward to identify unauthorized senders and legitimate services that need proper configuration.

DMARC policies range from permissive to strict. The "none" policy is monitoring-only — it won't affect mail delivery, but you'll still get reports. "Quarantine" tells receiving servers to treat failing messages with suspicion (usually by sending them to spam). "Reject" instructs servers to block failing messages entirely. Most organizations start with "none," review their reports for a few weeks, and then gradually tighten the policy once they're confident everything is set up correctly.