Free tool
DMARC record generator
Choose a policy and where reports should go, and get a DMARC record ready to paste — with advice on each setting so you tighten it safely.
Runs entirely in your browser. Nothing you type is sent to us.
The safe route to p=reject
- Make sure SPF and DKIM are in place for every service that sends as you — the SPF record generator helps.
- Publish DMARC at p=none with a reporting address.
- Read the reports for two to four weeks and fix anything legitimate that fails.
- Move to p=quarantine, optionally with a lower pct at first.
- When the reports stay clean, move to p=reject.
Our guide to SPF, DKIM and DMARC covers each step in more detail.
Questions
About DMARC records
Which DMARC policy should I start with?
p=none, with a reporting address. It changes nothing about delivery, but the reports show you every service sending as your domain and whether it passes. After a few weeks of clean reports, move to p=quarantine, then p=reject.
Where do I publish the DMARC record?
As a TXT record on the host _dmarc — so for yourcompany.co.uk, the full name is _dmarc.yourcompany.co.uk. A domain should have exactly one DMARC record.
Who should receive the reports?
An address you can actually read, or a DMARC reporting service that turns the XML reports into something readable. Reports can be numerous, so a dedicated address such as dmarc@yourcompany.co.uk is better than a person’s inbox.
What do adkim and aspf mean?
They set alignment. Relaxed (the default) lets a subdomain such as mail.yourcompany.co.uk count as aligned with yourcompany.co.uk; strict requires an exact match. Relaxed suits nearly everyone.
Want DMARC monitored for you?
Every MyExchangeServer customer has DMARC reports watched and the policy tightened safely. Send us your domain and we will tell you where you stand.
- Free assisted migration
- No set-up fee, no minimum term
- UK data centres, UK engineers