How to create a DMARC record and roll it out without breaking mail
In short: To create a DMARC record, publish a TXT record at _dmarc.yourdomain.com starting with v=DMARC1, a policy (p=none to begin), and a reporting address. A free DMARC Generator builds the exact string. Roll out slowly: none, then quarantine, then reject, moving up only when reports confirm your real mail passes.
On this page
Start safe with p=none
Never start at reject. Begin with p=none, which monitors without affecting delivery. You will receive aggregate reports showing every server that sends mail as your domain and whether it passes SPF and DKIM. This is how you discover forgotten senders before they get blocked.
How to create your DMARC record step by step
- Open the DMARC Generator. Go to the free Inboxlogy DMARC Generator.
- Choose your policy. Start with
none. - Add a reporting address. Enter where aggregate reports should go, for example
[email protected]. - Set optional tags. Choose alignment mode and percentage if needed. The defaults are fine for most senders.
- Publish the TXT record. Add it at the hostname
_dmarc.yourdomain.com.
How to move from none to reject
Raise enforcement in stages, not all at once:
- Weeks 1-2: p=none. Collect reports, confirm all legitimate mail passes SPF or DKIM with alignment.
- Weeks 3-4: p=quarantine. Failing mail goes to spam. Watch for any legitimate sender you missed.
- Week 5+: p=reject. Failing mail is blocked. This is full protection against spoofing.
You can also use the pct= tag to apply a policy to a percentage of mail while you gain confidence.
Verify after each step
After every change, confirm the record is live with the DMARC Checker, and make sure your SPF and DKIM still pass and align. DMARC only works when at least one of them does.
Build your DMARC record free
Generate a correct record, start safely at p=none with reporting, and roll out enforcement the right way.
Open the DMARC Generator →All free tools