Free · without registration
Check DMARC policy and create DNS record
Read your DMARC policy and check the inheritance on subdomains. Then, if necessary, create a DNS draft for your provider. Publication will remain under your control.
Start of test
Their results
DMARC connects domain and mail authentication
DMARC assesses whether a successfully verified SPF or DKIM identity matches the visible sender domain. The DNS record under _dmarc specifies the desired treatment of inappropriate messages and optional reporting targets. The domain check reads this configuration; a specific email and its actual alignment are not checked.
none, quarantine and reject
p=none is used for observation and does not require rejection based on the DMARC policy. quarantine asks for a more careful treatment, reject rejection. Recipients can apply their own rules. Start a transition with full coverage of all legitimate shipping services and evaluation of the reports. A stricter policy without prior matching can also affect legitimate emails.
Subdomains and the updated standard
The checker considers the DNS Tree Walk from RFC 9989 with a maximum of eight policy queries. A missing direct record therefore does not automatically mean that no policy exists for a subdomain. sp can affect existing subdomains, np non-existent subdomains. Older receivers can still use the rules from RFC 7489. The former pct parameter is marked as an old parameter and is not newly generated by the generator.
Use the generator safely
Enter your domain, the desired policy and optionally a set-up reporting mailbox. The generator generates name, record type, and content locally. Apply the content as a TXT record to your DNS provider; avoid multiple competing DMARC records. External reporting recipients may need additional clearance. The tool does not set up a mailbox and does not change DNS data. The basis is RFC 9989; Aggregated reports are in RFC 9990 described above.
Example of classification
v=DMARC1; p=none; rua=mailto:dmarc@example.org is an observation draft. An existing record with p=reject, on the other hand, is an enforcement policy and should only be set after checking all shippers.
Frequent questions
Does the generator publish the DNS record?
No. He creates a local text draft, which you enter yourself with the DNS provider.
Why is a policy of a higher-level domain displayed?
DMARC can be inherited on subdomains. The checker shows the source and distinguishes direct from inherited information.
Is the reporting address checked for accessibility?
No. Mailbox, acceptance of reports and any external release required must be set up separately.