Free DMARC Generator
Create an RFC 7489 compliant DMARC record in seconds. Features interactive phased rollout presets (p=none → quarantine → reject), custom telemetry report routing, and copy-paste DNS instructions for major cloud providers.
The Safe 3-Phase DMARC Rollout Strategy
Rushing straight to p=reject is the most common cause of self-inflicted email delivery outages. Modern companies rely on dozens of SaaS platforms sending email on their behalf: transactional receipts, marketing newsletters, customer support tickets, and CRM outreach.
To protect your brand without accidentally sending your own legitimate invoices to the black hole, follow this proven 3-phase rollout methodology:
Phase 1: Monitoring & Discovery (Days 1 – 30)
v=DMARC1; p=none; rua=mailto:[email protected];Publish with p=none. No messages are blocked. Mailbox providers send daily XML reports to your rua address. Ingest these reports to identify every legitimate IP sending email from your domain and ensure SPF and DKIM are properly configured for each one.
Phase 2: Quarantine Testing (Days 31 – 60)
v=DMARC1; p=quarantine; pct=25; rua=mailto:[email protected];Once known senders pass SPF/DKIM alignment, ramp up enforcement using p=quarantine. You can start with pct=25 and increase to 50%, then 100%. Spoofed emails land in spam, while any overlooked legitimate sender can still be recovered.
Phase 3: Strict Enforcement (Days 60+)
v=DMARC1; p=reject; pct=100; rua=mailto:[email protected]; aspf=r; adkim=r;Activate p=reject with 100% enforcement. Unauthorized senders are completely blocked by inboxes globally. Your domain is spoof-proof, phishing risk is eliminated, and you become eligible for BIMI (Brand Indicators for Message Identification) verified checkmarks in Gmail and Apple Mail!
Common DMARC Generator Pitfalls to Avoid
Publishing at the Root Domain
Always set the Host name to _dmarc. Publishing at @ will be ignored by mailbox servers.
Multiple DMARC Records
Having more than one DMARC record on a domain voids both according to RFC 7489. Keep only one.
Missing "mailto:" in rua
Tag values must be valid URIs: rua=mailto:[email protected], not just the plain email address.
Premature Strict Alignment
Strict alignment (aspf=s) breaks emails sent from subdomains like news.domain.com. Stick to relaxed alignment (r).
DMARC Generator FAQ
What does the pct tag do in DMARC?▾
The pct tag specifies what percentage of unauthenticated emails should have the policy applied. For example, p=quarantine; pct=20 instructs receivers to quarantine only 20% of failing messages, allowing the other 80% through to inboxes. This is helpful for large enterprises testing quarantine impact.
Can I send aggregate DMARC reports to an external domain?▾
Yes! However, if you send reports for company.com to an external email address like [email protected], RFC 7489 section 7.1 requires that thirdparty.com publishes an external verification record at company.com._report._dmarc.thirdparty.com to prevent report spamming.
How do I test my newly created DMARC record?▾
Once published to your DNS registrar, wait 5 minutes and test it with EmailSendy's free DMARC Record Checker. The tool will query live DNS, verify RFC 7489 syntax compliance, and calculate your domain health score.
Want Us to Handle DNS & Warm-up?
EmailSendy architects set up custom SPF, DKIM, DMARC, BIMI, and manage dedicated SMTP server clusters for enterprise senders.
Learn About Deliverability Services