Build a DMARC record step by step, from p=none reporting to p=reject
Runs in your browser. Only the lookup you start is sent to cloudflare-dns.com or dns.google; nothing else leaves your device. Updated on 18 Oct 2026.A DMARC record tells receiving mail servers what to do with mail that fails SPF and DKIM, and where to send the daily reports. Choose the policy, add the address that should get the reports, and the record and the exact name to publish it under are written for you. The usual path is p=none for a few weeks of reports, then quarantine, then reject. Nothing you type is sent anywhere.
Type your domain in Your domain.
Choose under Failing mail should be: Delivered (monitor), Sent to spam or Refused.
Type the mailbox for reports in Send daily reports to (rua).
Open More options for a subdomain policy, strict alignment or test mode if you need them.
Press Copy and publish the record as a TXT record at the name shown above it.
Type a domain and the page asks a public DNS-over-HTTPS resolver for the TXT record at _dmarc. followed by that name. The record is read tag by tag and then explained in sentences: what happens to failing mail, what happens for subdomains, how strictly SPF and DKIM must match the From address, and where the reports go.
The rules come from RFC 9989, published in May 2026, which replaced RFC 7489 as the DMARC standard. Two changes matter when reading older records. The pct tag has been removed: older receivers still use it to act on only part of the failing mail, newer ones ignore it. A t=y tag now means test mode, where receivers apply one step less than the policy. Both are flagged in words.
Report addresses on a different domain are checked for permission. RFC 9990 section 4 asks receivers to send reports to another domain only when that domain publishes a TXT record at the policy domain followed by ._report._dmarc. and the reporting host. A missing one is the usual reason a DMARC service receives nothing.
The rest of the article, and all 6 questions about DMARC Checker, are on the DMARC Checker page.
A policy of p=none asks receivers to deliver mail that fails DMARC as normal and only send reports. Forged mail using the domain still reaches inboxes. Owners use it for a few weeks to find every legitimate sender in the reports, then move to quarantine and finally reject.
Not necessarily. When a subdomain such as mail.example.com has no record, receivers use the record of the organisational domain, example.com, applying its sp= policy if it has one and p= otherwise. A subdomain can publish its own record to override that.
Three usual causes: the record has no rua= address; the address is on another domain that has not published the permission record at yourdomain._report._dmarc.theirdomain; or the record itself is invalid, for example two DMARC records at one name, which receivers discard. This checker tests all three.
Only to the public DNS resolver you choose, Cloudflare or Google, because looking up a DNS record needs the name. The resolver sees the names asked and your IP address. Nothing else leaves your device, and the generator tab sends nothing at all.
Still stuck? Ask about DMARC Checker and anybody who knows can answer. No account needed.
Same job, other tools: SPF Record Generator – Write an SPF record for your mail providers and see how many lookups it uses.
On the related tools: Find the Sender IP of an Email – Paste the headers of an email to find the IP address of the server that sent it.