Discuss your project

TOOLBOX · GENERATOR

Createa DMARC Record.

Choose a level, enter reporting addresses and copy the finished record: from p=none to p=reject, with every tag explained. Runs only in your browser.

Examples

An example fills the form with suitable values. Your domain is kept; if it is empty, example.at is used.

Domain

The domain in your sender address, without www. The record goes at _dmarc.<domain>.

Policy

What should receivers do with emails that fail both SPF and DKIM aligned with your domain? Follow the levels in order.

Level
Reports

Aggregate reports (rua) show who sends in your name. Without them, you cannot see the effect of moving to reject.

One address per line or separated by commas. The generator adds mailto:.

Reports about individual emails. They contain personal data; aggregate reports are usually sufficient.

Subdomains and Alignment

Without explicit settings, p and relaxed alignment apply. Change them only for a reason.

Your DMARC Record

Enter your domain above or select an example. The record is generated here as you type.

Browser only: this tool does not send your input to TOMORIS or third parties and does not store it.

STEP BY STEP

Monitor First.
Then Enforce.

DMARC protects your domain against forged senders, for example in CEO fraud (Business Email Compromise). Follow the staged approach described in RFC 9989.

  1. 01

    List Your Senders

    Record every service that sends with your domain and configure SPF and DKIM there. The SPF Generator builds the SPF record.

  2. 02

    Publish p=none

    Create the record with an aggregate reporting address. Receivers then send reports showing who sends in your name (RFC 9990).

  3. 03

    Analyze Reports

    For at least one month: which servers send for your domain, and do they pass SPF or DKIM? Add any missing services (RFC 9989, Section 7.4).

  4. 04

    quarantine, First with t=y

    In testing mode, receivers apply one level less strictly. If reports remain clean, remove t=y.

  5. 05

    Goal: reject

    Forged mail is then rejected. From now on, always add new services to SPF and DKIM first.

COMMON MISTAKES

Where DMARC
Often Goes Wrong.

  • Two DMARC Records

    If _dmarc has two records with v=DMARC1, receivers evaluate neither (RFC 9989, Section 4.10). Replace an existing record rather than adding another.

  • Record at the Wrong Name

    The record belongs at _dmarc.<domain>, rather than the domain itself. If your DNS provider adds the domain automatically, enter only _dmarc as the name.

  • v=DMARC1 Is Not First

    If v is not the first tag or is written differently from DMARC1, receivers ignore the entire record (RFC 9989, Section 4.7).

  • Starting with p=reject

    Without analyzing reports, reject also affects legitimate emails, for example from newsletter services, online shops or scanners.

  • pct from Old Instructions

    pct was removed in RFC 9989. Receivers following the new standard ignore it; use t=y for a testing phase.

  • External Address Without Authorization

    Reports to an external domain arrive only if that domain authorizes them with its own record (RFC 9990, Section 4).

SOURCES AND NEXT STEPS

Checked Against
the Standard.

The generator follows RFC 9989, which replaced RFC 7489 in May 2026. After publishing, verify the record with the email security check.

QUESTIONS

Good to Know.

Is my input sent to TOMORIS?

No. The generator runs entirely in your browser. The domain and reporting addresses are neither sent nor stored; they are gone when you close the page.

Which level should I start with?

Start with p=none and an aggregate reporting address. RFC 9989 describes a staged approach: first monitor and analyze reports for at least one month, then use quarantine for the same period, followed by reject (Sections 5.1 and 7.4). Domains that never send email can use p=reject immediately.

What happened to pct?

RFC 9989 removed the pct tag (Appendix A.6). Use t=y for a testing phase: receivers apply the policy one level less strictly, meaning quarantine for reject, and no action for quarantine. The generator therefore no longer outputs pct.

Do I need SPF and DKIM first?

Yes. DMARC evaluates SPF and DKIM and requires one of them to align with the domain in the visible sender address. Under RFC 9989, anyone using p=reject must not rely on SPF alone and must sign with DKIM because SPF fails when mail is forwarded (Section 7.4).

Why are no reports arriving at an external address?

If the reporting address uses another domain, receivers send reports only with that domain’s authorization: a TXT record containing “v=DMARC1” at <your domain>._report._dmarc.<address domain> (RFC 9990, Section 4). The generator shows this record; analysis services usually create it themselves.

TOOLBOX

More
Tools.

YOUR NEXT STEP

You Have the Result.
What Comes Next?

We assess findings, prioritize by risk and put changes into practice on request: as a project with EXPERTS or as ongoing operations with GRID.

Discuss the Result