How to create a DMARC record, step by step

A DMARC record is a single DNS TXT record published at _dmarc.yourdomain. It tells email receivers what to do with mail that claims your domain but fails SPF or DKIM. Creating one takes minutes. Getting it right the first time is the part most guides skip. This is the short version.

Step 1: decide your starting policy

Start with p=none. It changes how no one's mail is treated; it only sends you aggregate reports about who is sending as your domain. You need that picture before you enforce anything. Moving to p=quarantine and then p=reject comes later, once the reports prove your legitimate senders all authenticate. Here is what each policy actually does.

Step 2: pick a reporting address

The rua= tag is where receivers send their aggregate reports. Use an address you (or your email team) will actually check, ideally one that is not a single person's inbox. reports@yourdomain.com is a common choice. This is also the one field that must be a valid, deliverable mailbox or the reports simply vanish.

Step 3: build the record

The minimum record that works looks like this:

v=DMARC1 is required and must be first. p=none is your policy. rua= is where reports go. pct=100 means the policy applies to all failing mail (you can lower it to test enforcement on a slice). You can add more tags later, but this is the correct, safe starting point.

Rather than hand-build it, the free DMARC record generator writes the exact TXT for you from your domain, policy and reporting address, and shows where to paste it in Cloudflare, GoDaddy, Namecheap, Route 53 and Google Workspace.

Step 4: add it to your DNS

In your DNS provider, add a TXT record. The host/name is _dmarc (some providers ask for the full _dmarc.yourdomain; a few only want the subdomain part). The value is the record from step 3. Leave the TTL at the default or "auto." Save.

One record only. If you already have a DMARC TXT at _dmarc, you are replacing it, not adding a second one. Duplicate or conflicting DMARC records make the whole record invalid to most receivers.

Step 5: confirm it is live

DNS propagation takes anywhere from a few minutes to several hours. Once it is live, a lookup of _dmarc.yourdomain returns your record. The free DMARC checker confirms it is published and readable, and shows your SPF and DKIM alignment at the same time, so you know the record is actually doing something useful.

What to do after it is live

Watch the reports for a few weeks. They list every sender that used your domain, whether it authenticated, and from which IP. Fix the senders that fail (usually a missing DKIM signature or an SPF that does not cover a system), then move p= from none to quarantine, and to reject only after a clean run. That is the whole path from "record exists" to "domain is protected."

Related: What is DMARC? · p=none vs quarantine vs reject · SPF vs DKIM vs DMARC

Want this checked automatically every day? Inboxproof Pro monitors your domain around the clock and alerts you the moment a record breaks or an IP gets listed. See pricing →