# DMARC Record Generator Source: https://wraps.dev/tools/dmarc-builder ![Wraps Logo](https://wraps.dev/wraps-light-logo.png)![Wraps Logo](https://wraps.dev/wraps-dark-logo.png) ](https://wraps.dev/) [](https://github.com/wraps-team/wraps)[Log in](https://app.wraps.dev/auth?mode=signin)[Sign up](https://app.wraps.dev/auth?mode=signup) Toggle menu wraps ยท free tool Answer a few questions, copy the TXT value, and see which choices would break your mail before you publish them. Runs in your browser. Your policy Domain (optional) Used to name the DNS record and to spot report addresses on other domains. Nothing is sent anywhere. Policy (p) Subdomain policy (sp) Non-existent subdomains (np) Testing mode (t=y) Asks receivers not to enforce. DMARCbis uses this in place of the retired pct tag. DKIM alignment (adkim) SPF alignment (aspf) Aggregate report addresses (rua) One or more, separated by commas or new lines. mailto: is added for you. Forensic report addresses (ruf) Failure reporting options (fo) Only written to the record when a valid ruf address is set. TXT recordCopy v=DMARC1; p=none DNS record Type TXT, name \_dmarc.. Some DNS hosts want just \_dmarc in the name field. No rua address, so you get no aggregate reports and cannot see which senders fail. p=none is monitoring only. Nothing is enforced, so spoofed mail is still delivered. Read the aggregate reports for a few weeks, fix every legitimate sender that fails, then move to quarantine and finally reject. ## What the generator writes Pick a policy, add a report address, and the tool writes the TXT value for \_dmarc.yourdomain.com. Tags come out in a fixed order: v, p, sp, np, t, adkim, aspf, rua, ruf, fo. Optional tags you leave unset are left out, and alignment is only written when you choose strict, because relaxed is the default. It does not write pct, ri or rf. The pct tag is retired in the DMARCbis revision, and receivers that follow it ignore the value, so a partial rollout percentage gives you a false sense of safety. If you want to try a policy without enforcing it, use t=y. Our DMARC record checker warns on pct below 100 for the same reason, so a record built here will not trip it. ## Start at p=none, and read the reports The builder warns when you pick quarantine or reject, because a policy you enforce on day one breaks every legitimate sender that is not aligned yet. That is usually a CRM, a billing tool, a support desk or a script somebody wrote three years ago. You will not find them by guessing. You find them in the aggregate reports. The path is boring and it works. Publish p=none with an rua address. Read the reports for a few weeks, fix each source that fails, then move to quarantine, watch, and move to reject. Receivers make the final call on every message, so a policy is a request, not a guarantee. Large providers mostly honor it. ## How the tags interact The sp tag sets the policy for subdomains. If you set sp=none while p is quarantine or reject, mail spoofed from a subdomain is not enforced, and the tool flags it. The np tag covers subdomains that do not exist in DNS. Setting np=reject on an enforcing policy closes that gap. The t=y flag tells receivers not to enforce. It is useful while you test, and it also means a p=reject record does nothing until you remove it. The tool warns when both are set. SPF alignment is checked against the envelope sender and DKIM alignment against the d= domain in the signature. Relaxed accepts any subdomain of the same organizational domain. Strict needs an exact match. Most senders should leave both relaxed. ## Report addresses on other domains If an rua or ruf address is on a different domain than the one you are protecting, receivers will not send reports there unless that domain publishes an authorization record. The record lives at yourdomain.com.\_report.\_dmarc.theirdomain.com and holds v=DMARC1. Report-processing services normally tell you to add it. When you enter a domain above, the tool points this out for any external address. Addresses that are not valid mailto: targets are left out of the record and listed in a warning, so a typo does not silently produce a broken tag. ## What this tool does not do It builds text. It does not publish anything, read your DNS, or look at your reports. The domain you type and the addresses you enter stay in your browser. Once you publish the record, run it through the DMARC record checker to confirm it resolves as written. A valid record is one input to deliverability, next to reputation, content and complaint rates. It does not guarantee inbox placement. ## Questions ### What should my first DMARC record be? v=DMARC1; p=none with an rua address. It enforces nothing, so no mail is blocked, and the aggregate reports show every source sending as your domain. Tighten the policy after you have fixed the sources that fail. ### Why does the generator not offer a percentage? The pct tag is retired in the DMARCbis revision and receivers that follow it ignore the value. Use t=y while testing. Our checker warns on pct below 100. ### Where do I put the record? Create a TXT record named \_dmarc on your domain. Some DNS hosts want the full name \_dmarc.yourdomain.com and some append the domain for you, so check how yours displays existing records. ### Do I need ruf? No. Many receivers never send forensic reports because they can contain message content. Aggregate reports through rua are the ones most teams use. ## Keep going Published it? Run the [DMARC record checker](https://wraps.dev/tools/dmarc-checker) to confirm it resolves the way you wrote it. For why passing SPF and DKIM can still fail DMARC, read [DMARC alignment](https://wraps.dev/glossary/dmarc-alignment), and [why a DMARC policy can be useless](https://wraps.dev/blog/your-dmarc-policy-is-useless) when it is never enforced.