A DMARC record is a DNS TXT record at _dmarc.yourdomain.com that tells receiving mail servers what to do with messages that fail SPF or DKIM. A correct starter DMARC record is v=DMARC1; p=none; rua=mailto:reports@yourdomain.com. Move to p=quarantine after 2-4 weeks of monitoring, then p=reject once all legitimate senders align. Use the generator below.
DMARC Generator
Pick your policy, rollout %, and reporting addresses. The TXT record updates live as you change them.
p
Advanced
Your DMARC record
_dmarc.yourdomain.comv=DMARC1; p=none
DMARC Checker
What Is DMARC?
DMARC (Domain-based Message Authentication, Reporting, and Conformance, defined in RFC 7489) is the third leg of the cold email authentication trio. It does two things: (1) tells receiving mail servers what to do when a message fails both SPF and DKIM alignment with your From domain, and (2) asks receivers to send reports about authentication results so you can see what's happening in the wild.
DMARC requires SPF OR DKIM to pass AND align with the From domain. Without SPF or DKIM published, every message fails DMARC. Always publish SPF and DKIM first.
Safe Rollout Path
Jumping straight to p=reject on a live domain will block every forgotten sender you didn't realize existed. Use this rollout:
- Week 1-2: Publish
v=DMARC1; p=none; rua=mailto:reports@yourdomain.com. Review aggregate reports daily. Add any legitimate senders you find to SPF and/or configure DKIM for them. - Week 3-4: Move to
p=quarantine; pct=25. Watch reports for 1-2 weeks. If no legitimate mail is quarantined, step up topct=50, thenpct=100. - Week 5+: Move to
p=reject; pct=100. This is the strongest protection against spoofing of your domain.
This gradual path is for domains that already carry mail from several services. A brand-new cold email domain that sends from one platform has nothing to discover, so it can start at p=reject. That is what Winnr does by default; see why Winnr uses DMARC p=reject.
How to Publish Your DMARC Record
- Copy the generated record from the box above.
- Log in to your DNS host.
- Create a new TXT record with host/name
_dmarc(not the root: DMARC lives at the_dmarcsubdomain). - Paste the generated value. Leave TTL at 3600 or the default.
- Save. Wait 1-15 minutes for propagation, then verify with the checker above.
Tag Reference
| Tag | Purpose | Example |
|---|---|---|
v | Version (required, always DMARC1) | v=DMARC1 |
p | Policy for failing messages | p=quarantine |
pct | Percent of failing messages to apply policy to (1-100) | pct=50 |
rua | Aggregate report mailbox (daily XML summaries) | rua=mailto:reports@example.com |
ruf | Failure (forensic) report mailbox (many receivers don't send these) | ruf=mailto:forensics@example.com |
sp | Policy for subdomains (defaults to p) | sp=reject |
adkim | DKIM alignment: r (relaxed) or s (strict) | adkim=r |
aspf | SPF alignment: r (relaxed) or s (strict) | aspf=r |
Next up: Pair DMARC with SPF and DKIM. All three are required in 2026.
Frequently Asked Questions
What is a DMARC record?
DMARC (Domain-based Message Authentication, Reporting, and Conformance) is a DNS TXT record published at _dmarc.yourdomain.com that tells receiving mail servers what to do with messages that fail SPF or DKIM alignment. A DMARC record looks like v=DMARC1; p=quarantine; pct=100; rua=mailto:reports@yourdomain.com.
Do I need DMARC for cold email?
Yes. Since February 2024, Google and Yahoo require a DMARC record (at least p=none) from any domain sending more than 5,000 messages a day to their users, and Microsoft applies a similar rule to high-volume senders to Outlook.com. Publish DMARC on every cold email domain, even if you send less than that.
What is the difference between p=none, p=quarantine, and p=reject?
p=none is monitor-only: receivers take no action and you just get reports. p=quarantine asks receivers to treat failing messages as suspicious, usually by sending them to spam. p=reject asks receivers to refuse failing messages. On a domain with existing senders, start with p=none for 2-4 weeks to collect reports, move to p=quarantine for another 2-4 weeks, and go to p=reject once all legitimate senders align.
What is the pct tag in DMARC?
pct is the percentage of failing messages the policy applies to. pct=100 (the default) applies it to all failing messages; pct=25 applies it to about a quarter of them, which is useful for a gradual move to p=quarantine or p=reject.
What is a rua address?
rua is the address that receives DMARC aggregate reports: daily XML summaries of authentication results from receivers that send them. Format: rua=mailto:dmarc-reports@yourdomain.com. A DMARC reporting service can parse the XML into a readable dashboard. If the address is on a different domain, that domain must publish a record authorizing it.
What is the difference between rua and ruf?
rua receives aggregate reports: daily XML summaries of pass and fail counts by sending IP. ruf receives failure (forensic) reports about individual messages. Many large receivers don't send ruf reports for privacy reasons, so treat it as optional. Always include rua.
What does DMARC alignment mean?
Alignment means the domain in the visible From header matches the domain that passed SPF (the envelope sender) or DKIM (the d= signing domain). Relaxed alignment, the default, accepts the same organizational domain, so mail.example.com aligns with example.com. Strict alignment requires an exact match. Relaxed is the right choice for most cold email setups.
Does Winnr set up DMARC automatically?
Yes. Every domain where Winnr hosts DNS gets SPF, DKIM, and DMARC automatically. Winnr's default DMARC policy is p=reject; on those domains it also includes a reporting address and can be changed from the DNS Records tab. For a manually connected domain, Winnr shows the DMARC record to copy.
How do I check my DMARC record?
Use the DMARC Checker on this page. Enter your domain and the tool looks up the TXT record at _dmarc.yourdomain.com over DNS-over-HTTPS (Google Public DNS, with Cloudflare as a fallback) and lists the policy and reporting tags. From a terminal, run dig TXT _dmarc.example.com +short.
Can I have a DMARC record without SPF or DKIM?
You can publish one, but every message will fail DMARC, because DMARC needs SPF or DKIM to pass and align with the From domain. With p=quarantine or p=reject, that means your own mail gets filtered or refused. Publish SPF and DKIM before enforcing DMARC.
Related tools: SPF Record Generator · DKIM Record Generator · Domain Health Checker · Cold Email Calculator. Related reading: Cold Email DNS Setup Checklist. Want SPF, DKIM, and DMARC handled for you? See Winnr pricing.