ONDUU / EMAIL HEALTH

DMARC Generator

Generate a DMARC DNS TXT record for your domain and copy the exact value to publish.

Your record

Showing example.com as a placeholder. Enter your own domain above.

1. DNS host / name

_dmarc.example.com

2. DMARC TXT value

v=DMARC1; p=none; adkim=r; aspf=r; pct=100; fo=0; ri=86400

3. DNS zone block

Host/Name: _dmarc.example.com
Type: TXT
TTL: Auto
Value: v=DMARC1; p=none; adkim=r; aspf=r; pct=100; fo=0; ri=86400

Nothing is sent anywhere — this record is built in your browser.

01 / BEFORE YOU PUBLISH

Four things worth knowing.

Start with p=none while you monitor aggregate reports. It changes nothing about how your mail is treated, and it starts the reports that tell you who is sending as you. Monitoring is the correct first step — the mistake is stopping there. Once the reports show every real sender passing, move to quarantine, then reject.
Publish only one DMARC TXT record for each domain. Two records is not a stricter policy; it is an invalid configuration, and receivers ignore both.
Most DNS panels accept _dmarc as the Host or Name. This tool shows the full hostname for clarity. If your panel already appends the domain, enter just _dmarc.
rua reports are aggregate XML reports from participating mailbox providers. They carry counts and sending sources, not the content of anyone’s mail, and they arrive roughly daily.

02 / WHAT THIS DOES NOT DO

A generator is not a check.

This builds a record from what you enter. It cannot tell you whether the record reaches DNS, whether your DNS panel stored it intact, or whether the senders you rely on actually pass. Publishing is the step that decides those, and only a lookup against public DNS can confirm them.

Once the record is live and DNS has propagated, run Email Health against the same domain to see what receivers now see. For the mechanics behind SPF, DKIM and DMARC, the email and trust guide covers them in depth.

Nothing you type here is sent anywhere or stored. The record is built in your browser, and the page makes no network request of its own.

03 / THE TAGS

What each part of the record means.

Glossary

Term	Meaning
✓ Green	Checked and well.
✕ Red	Not used here — this page reports no verdicts. It builds a record; Email Health is what grades one.
○ Grey	Every tag above is optional except the version and the policy. Anything you leave blank is left out of the record entirely.
v=DMARC1	The version tag. Every DMARC record starts with it, and a record that does not is ignored.
p=	Your instruction to receivers about mail that fails: none watches only, quarantine sends failures to spam, reject refuses them.
sp=	The same instruction for subdomains. Left out, subdomains inherit the main policy.
rua=	Where aggregate reports are sent. These are daily XML summaries from participating mailbox providers — counts and sources, never message content.
ruf=	Where forensic reports are sent. Per-message and far rarer; many providers never send them at all.
adkim= / aspf=	How closely the signing or sending domain must match the address a reader sees. Relaxed allows a subdomain; strict demands an exact match.
pct=	The share of failing mail the policy is applied to. A way to move to quarantine or reject gradually rather than all at once.
fo=	Which failures are worth a forensic report: both mechanisms failing, either one, or DKIM and SPF separately.
ri=	How often you want aggregate reports, in seconds. 86400 is one a day, which is what most providers send regardless.
_dmarc	The host the record is published at. Your DNS panel may ask for just _dmarc, or for the full _dmarc.yourdomain.