DMARC record generator
Create a DMARC TXT record with your policy and report address. DMARC checks whether SPF or DKIM passes with a domain aligned to the visible From address. Publish the record, verify it in DNS, and review reports before enforcing it.
v=DMARC1; p=none; rua=mailto:[email protected]_dmarc.yourdomain.com.What each tag does
p= requests handling for mail that fails DMARC. none requests no specific action, quarantine asks receivers to treat it as suspicious, and reject asks receivers not to deliver it. Receivers can still apply their own policy.
rua= lists the addresses participating receivers can use for aggregate reports, written as mailto: URIs.
t=y marks the policy as testing and asks receivers not to apply its enforcement policy. Remove it when you are ready to enforce p= or sp=.
sp= sets a separate policy for subdomains. Leave it inherited and subdomains follow p=.
adkim= and aspf= control alignment strictness. Relaxed alignment accepts authenticated domains with the same Organizational Domain as the From: address. Strict alignment requires an exact match. The tool only writes adkim=s or aspf=s when you switch to strict.
From monitoring to enforcement
Publish p=none with a report address first. Reports from participating receivers show which services send with your domain and whether they pass DMARC. Fix authentication for legitimate senders before switching to p=quarantine or p=reject. Allow enough time to collect reports from every service you use.
Loops provides a default DMARC record during domain setup. Publish and verify it in DNS. Use this generator when you want to set your own policy, report address, or alignment.
DMARC policy not enabled: what it means
A checker may show this warning for p=none. That is a valid policy that requests no DMARC-specific action on failing mail. The warning alone tells you nothing about SPF or DKIM. Check the published record before changing it.
Before choosing quarantine or reject, review reports and fix legitimate senders that fail alignment. If the record includes t=y, it is in testing mode. Remove that tag when you are ready to enforce the policy. Receivers still make their own delivery decisions.
Check the published policy with the DNS checker. If SPF is the problem, read how SPF records and alignment work. The policy definitions are in RFC 9989.
Add a DMARC record in Cloudflare
Open your domain’s DNS Records page in Cloudflare. Look for a TXT record at the DMARC hostname. If one exists, edit it rather than adding a second policy.
To add a policy, choose Add record and select TXT. In the example.com zone, use _dmarc for example.com or _dmarc.mail for mail.example.com. Paste the generated record into Content and save. Confirm the resulting hostname.
After DNS caches refresh, run the DNS checker for the domain you entered in the generator. Confirm the policy and report address.
See Cloudflare’s DNS instructions for the dashboard steps. For a Loops sending domain, copy the records from domain settings.
FAQ
Where do I put the record?
Which policy should I start with?
Can reports go to an address on a different domain?