Free tool
DMARC record generator
Answer three questions and copy the exact TXT record, plus the exact host name to put it on. Built for the staged rollout: monitor first, enforce when the reports are clean.
Optional: pct, alignment, subdomain policy
TXT record value
v=DMARC1; p=nonePublish it on this host
_dmarc.<your-domain>Record type TXT. Some DNS panels want only _dmarc in the name field and append your domain themselves.
- p=none with no report address monitors nothing and enforces nothing. Add an address so the record does some work.
The rollout, in three lines
- Publish p=none with a rua address and read the reports.
- Fix authentication for every legitimate sender the reports reveal.
- Move to quarantine, then reject, once reports stay clean at each step.
These checks are one-shot by design: running them on a schedule is not what SendHeron does. SendHeron is lifecycle email automation for SaaS, built by people who obsess over this layer of email, and it is in private beta. Join the waitlist if you want that kind of care under your sending.
What each tag means
v=DMARC1 declares the record type and must come first. p is the policy receivers apply to mail that fails DMARC: none delivers it normally, quarantine sends it to spam, reject refuses it. rua is the mailbox that receives aggregate reports, the XML summaries that show who is sending as your domain. Those three are the working core of nearly every record.
The rest is tuning. sp sets a separate policy for subdomains, which otherwise inherit p. pct applies quarantine or reject to only a percentage of failing mail, so you can enforce gradually. adkim and aspf switch alignment from relaxed to strict, which requires exact domain matches instead of accepting subdomains of the same organization; leave them relaxed unless you know why you need strict.
Where the record goes
The record is a TXT record on the host _dmarc.yourdomain.com. In most DNS panels you enter only _dmarc as the record name, because the panel appends your domain itself; if you see the record appear at _dmarc.yourdomain.com.yourdomain.com, that is what happened in reverse, and the fix is shortening the name field. Publish exactly one record there: a second DMARC record does not add to the first, it cancels both.
The staged rollout
Start at p=none with a rua address, and change nothing else about your mail. Read the reports as they arrive: they will name every service sending as your domain, including the ones you forgot. Fix authentication for the legitimate ones until the reports show aligned passes across the board.
Then move to p=quarantine, watch the reports the same way, and finally to p=reject. The pct tag can soften each step by applying the new policy to a fraction of failing mail first. There is no correct number of days per stage: the reports staying clean is the gate, and moving before that is how legitimate mail ends up in spam.
Worth reading next: SPF, DKIM and DMARC explained from scratch
Questions
DMARC record generator, in detail
Private beta
Email automation by people who obsess over this layer
SendHeron is lifecycle email for SaaS: sequences, tags, and an API, running on authentication done properly. We onboard a small number of teams at a time.
The rest of the toolkit
- DMARC checkerRead any domain's DMARC record: policy, reports, and what to fix.
- SPF checkerResolve the whole SPF tree and count lookups against the limit of 10.
- DKIM checkerTest a DKIM key by selector, or probe 15 common selectors at once.
- Email deliverability testMX, SPF, DKIM and DMARC in one pass, with a prioritized fix list.