Create a record

DMARC generator

Set up impersonation protection in safe stages.

Collect reports first, then raise protection gradually.

Domain (optional; for the check link)Policy (p)What should happen to emails that fail authentication?Subdomain policy (sp)A separate policy for subdomains such as mail.example.com. If empty, the main policy applies.Enforcement rate (pct)The percentage of emails the policy applies to. Start low for a gradual rollout, then raise it to 100.Summary report address (rua)Where daily aggregate reports are sent. Use mailto: and separate several addresses with commas.Forensic report address (ruf)Where copies of individual failed messages go. Most providers do not send these, so you can leave it empty.DKIM alignment (adkim)Relaxed: subdomains are allowed (recommended). Strict: the domain must match exactly.SPF alignment (aspf)Relaxed: subdomains are allowed (recommended). Strict: the domain must match exactly.Report interval (ri)Report interval in seconds. If empty, 86400 (once a day) is assumed.Failure report condition (fo)When to request detailed failure reports. If empty, only when both SPF and DKIM fail.

Start here: use p=none to watch reports and verify every sending source.

Value to paste in DNS

v=DMARC1; p=none

Generated with gugu.tr. Results reflect the state at the time of the test.

What should I do?

1Keep the “monitor only” choice to begin; it avoids blocking real email.
2Add an email address where you can read reports.
3After publishing, review reports and raise protection only once every sender is known.

In your DNS panel: Type: TXT · Name: _dmarc · Value: the preview below. Starting in monitor-only mode is the safest path.

Before using this DMARC record

This tool creates a DMARC record draft that tells receivers what to do based on SPF and DKIM results. It also lets you receive reports about sources sending with your domain.

Moving to a reject policy too quickly can reject legitimate mail from a forgotten source. Start with visibility, then move to protection.

What should I do?

Set up SPF and DKIM first, and check that they align with the From domain in your messages.
Start with p=none and a rua address where you can read reports, then verify every legitimate source.
Fix issues before moving gradually to p=quarantine, then finally p=reject.

Frequently asked questions

What is the rua address for?

It receives aggregate DMARC reports from receivers. Those reports help you see which servers send mail using your domain.

What does pct do?

It sets the percentage of messages to which the policy applies. During a rollout, start with a small percentage and safely observe the effect.

Does this tool add the record to my DNS?

No. You publish the generated value yourself as a TXT record at _dmarc in your DNS provider.