Truvo Free Tools

DMARC record generator

A DMARC record is a TXT record published at _dmarc.yourdomain.com. It tells receiving mail servers what to do with a message that fails SPF and DKIM alignment, and where to send reports about it. This generator builds the record from the tags you choose: p, sp, rua, ruf, pct, adkim, aspf, and the np and t tags from RFC 9989.

SOC 2 CC6.1SOC 2 CC6.7SOC 2 CC7.2ISO 27001 A.5.14ISO 27001 A.8.20
Ali Aleali

Ali Aleali, CISSP, CCSP

Co-Founder & Principal Consultant

Former security architect for Bank of Canada and Payments Canada. 20+ years building compliance programs for critical infrastructure. These tools come out of that work.

Connect on LinkedIn

How the DMARC record generator works

The record string is assembled in your browser as you pick tags. Nothing is published for you: you copy the finished record and add it to your DNS yourself.

01

Pick the policy

p sets what receivers do with mail that fails alignment: none reports only, quarantine sends it to spam, reject blocks it. sp sets a separate policy for subdomains. np, added in RFC 9989, sets the policy for subdomains that do not exist, which are a common target because they never send legitimate mail.

02

Add reporting and alignment

rua takes the address for aggregate reports, ruf for failure reports. adkim and aspf set DKIM and SPF alignment to relaxed or strict. pct applies the policy to a share of mail while you roll out, and t, added in RFC 9989, marks the record as being in a testing phase.

03

Publish and confirm

Copy the record, publish it as a TXT record at _dmarc., then confirm it resolves with the DMARC record checker. A record at reject with a working rua address is evidence for SOC 2 CC6.1, CC6.7 and CC7.2, and for ISO 27001:2022 A.5.14 and A.8.20.

Rolling DMARC to reject? We do that work.

Truvo's security engineers set the policy, fix the senders that break when it tightens, and hand you the evidence an auditor asks for. Tell us the domain and we will scope the work.

Contact us

  • DMARC to reject

  • SPF and DKIM

  • Report monitoring

  • Sender inventory

  • Audit evidence

  • Fixed-price scope

DMARC record generator: frequently asked questions

A single TXT record string, starting with v=DMARC1, that you publish at _dmarc.yourdomain.com. It carries the tags you selected: the policy (p), the subdomain policy (sp), the policy for non-existent subdomains (np), reporting addresses (rua and ruf), alignment modes (adkim and aspf), the rollout percentage (pct) and the testing flag (t).

Starting at p=none with a rua address lets you collect aggregate reports without changing how any mail is delivered. The reports name every source sending as your domain, including the ones nobody remembers setting up. Once every legitimate sender passes SPF or DKIM alignment, you can move to quarantine and then to reject.

np sets the policy applied to subdomains that have no DNS records at all. Those subdomains never send legitimate mail, so a strict np can be set before the organizational domain is ready for it. t marks the record as being in a testing phase, which tells receivers you are still tuning. Both tags come from RFC 9989.

No. DMARC evaluates the result of SPF and DKIM and checks that the domain each one authenticates aligns with the domain in the From header. With neither in place, every message fails alignment, and a policy of quarantine or reject would stop your own mail. Publish SPF and DKIM first, confirm they pass, then tighten DMARC.

Both frameworks ask how you protect information in transit and how you would detect misuse of your systems. A DMARC record at reject, with reporting going somewhere a person reads, is direct evidence that mail spoofing your domain is blocked and that the attempts are visible. A missing record is a gap an auditor will ask you to explain.