DMARC record generator
Fill in the fields and copy the DNS record. Everything is worked out in your browser, nothing you type is sent anywhere or stored.
Your DMARC record
Enter a valid domain above and the record appears here.
What this covers in your audit
Email authentication supports SOC 2 Trust Services Criteria CC6.6 and CC6.7, and ISO 27001:2022 Annex A 8.20 and A 5.14.
A published DMARC record gives an auditor something concrete to look at: the organisation has stated what receivers should do with mail that claims to come from its domain and fails authentication, and it receives reports on who is sending as that domain.
This contributes evidence toward those controls. It does not satisfy them on its own. An auditor will also want to see that someone reads the aggregate reports, that the policy moves toward enforcement, and that the surrounding process is written down.
What you need to know
Start at p=none, then tighten
p=none changes nothing about delivery. It only turns on reporting, so you can see every source sending as your domain, including ones you forgot about. Once the reports show only your legitimate senders passing, move to p=quarantine, then to p=reject. Going straight to reject before you know your senders will block your own mail.
What aggregate reports are for
The address in rua receives a daily XML summary from each receiving provider: which IP addresses sent mail as your domain, how many messages, and whether SPF and DKIM passed. This is how you discover shadow IT, expired third-party senders and active spoofing attempts. The files are machine readable, so most teams point rua at a DMARC reporting service rather than a person's inbox.
Give DNS time to propagate
After you publish the TXT record, resolvers can take up to 48 hours to pick it up, depending on the TTL of your previous record. Do not judge the result until then.
One DMARC record per domain
The record lives at _dmarc.yourdomain.com, not at the root. Publishing two DMARC records at that name is invalid and receivers will ignore both.
np and t, the newer tags
np sets the policy for subdomains that have no DNS records at all. Those names are a common target for spoofing because nobody is watching them, so np is usually set stricter than sp. t=y asks receivers to treat the policy as a test: they report as normal but do not act on the result. Support for both is good but not universal, and a receiver that does not understand a tag ignores it rather than failing the record.