ONDUU / EMAIL HEALTH

DMARC Generator

Add the generated DMARC to your DNS.

DNS recordDomainPaste the address if it is easier — a scheme, path or trailing slash is removed for you.TTL

PolicyPolicy (p)Subdomain policy (sp)Non-existent subdomains (np)Covers subdomains that do not exist at all — a common route for forged mail. reject is the usual choice and costs nothing, since no real mail comes from a subdomain you never created.

ReportsAggregate report addresses (rua)Separate several with commas. The mailto: prefix is added for you.Forensic report addresses (ruf)Optional, and many providers never send these.Failure reporting (fo)Only published when a forensic address is set.

AlignmentDKIM alignment (adkim)SPF alignment (aspf)

TestingTesting (t)t=y keeps the reports coming while telling receivers to ignore your policy. It replaces the old pct tag — but receivers still on the previous standard do not recognise it and will enforce your policy as written.

Your record

Showing example.ke as a placeholder. Enter your own domain above.

1. DNS host / name

_dmarc.example.ke

2. DMARC TXT value

v=DMARC1; p=none; adkim=r; aspf=r

3. DNS zone block

Host/Name: _dmarc.example.ke
Type: TXT
TTL: Auto
Value: v=DMARC1; p=none; adkim=r; aspf=r

Nothing is sent anywhere — this record is built in your browser.

01 / BEFORE YOU PUBLISH

Four things worth knowing.

Start with p=none while you monitor aggregate reports. It changes nothing about how your mail is treated, and it starts the reports that tell you who is sending as you. Monitoring is the correct first step — the mistake is stopping there. Once the reports show every real sender passing, move to quarantine, then reject.
Publish only one DMARC TXT record for each domain. Two records is not a stricter policy; it is an invalid configuration, and receivers ignore both.
Most DNS panels accept _dmarc as the Host or Name. This tool shows the full hostname for clarity. If your panel already appends the domain, enter just _dmarc.
rua reports are aggregate XML reports from participating mailbox providers. They carry counts and sending sources, not the content of anyone’s mail, and they arrive roughly daily.
np=reject is the cheapest protection here. It covers subdomains that do not exist, which is a common route for forged mail precisely because nobody is watching a name that was never created. No real mail comes from one, so there is nothing to break.
Use t=y to watch before you enforce, not a percentage. The pct tag was removed from the standard in May 2026 and this tool no longer produces it. One caveat worth knowing: receivers still on the previous standard do not recognise t= and will apply your policy as written, so a record set to test can enforce in some places and not others.

02 / WHAT THIS DOES NOT DO

A generator is not a check.

This builds a record from what you enter. It cannot tell you whether the record reaches DNS, whether your DNS panel stored it intact, or whether the senders you rely on actually pass. Publishing is the step that decides those, and only a lookup against public DNS can confirm them.

Once the record is live and DNS has propagated, run Email Health against the same domain to see what receivers now see. For the mechanics behind SPF, DKIM and DMARC, the email and trust guide covers them in depth.

Nothing you type here is sent anywhere or stored. The record is built in your browser, and the page makes no network request of its own.

03 / THE TAGS

What each part of the record means.

Glossary

Term	Meaning
✓ Green	Checked and well.
✕ Red	Not used here — this page reports no verdicts. It builds a record; Email Health is what grades one.
○ Grey	Every tag above is optional except the version and the policy. Anything you leave blank is left out of the record entirely.
v=DMARC1	The version tag. Every DMARC record starts with it, and a record that does not is ignored.
p=	Your instruction to receivers about mail that fails: none watches only, quarantine sends failures to spam, reject refuses them.
sp=	The same instruction for subdomains that exist. Left out, subdomains inherit the main policy.
np=	The instruction for subdomains that do NOT exist — a common route for forged mail, since nobody is watching a name you never created. Left out, it falls back to sp, then p.
t=	Testing. t=y tells receivers to send you reports but not to apply your policy, so you can watch before you enforce. It replaced the pct tag in May 2026.
rua=	Where aggregate reports are sent. These are daily XML summaries from participating mailbox providers — counts and sources, never message content.
ruf=	Where forensic reports are sent. Per-message and far rarer; many providers never send them at all.
adkim= / aspf=	How closely the signing or sending domain must match the address a reader sees. Relaxed allows a subdomain; strict demands an exact match.
fo=	Which failures are worth a forensic report: both mechanisms failing, either one, or DKIM and SPF separately.
_dmarc	The host the record is published at. Your DNS panel may ask for just _dmarc, or for the full _dmarc.yourdomain.