SITE UNDER CONSTRUCTION. Everything here is provided AS IS, WITHOUT WARRANTIES, to the extent the law allows. It is information, not professional advice. Use at your own risk. Terms and liability limits →

eThorns ES
Menu
Buy us a coffeeEspañoleThorns 2026 · Made in Colombia
← DNS, email & networkES

Tool 2.9

DMARC record generator: none, quarantine, reject

Build a DMARC TXT record: policy, test mode, report addresses and alignment. Shows the _dmarc host, and the record an outside report address needs.

Runs on your deviceRuns entirely in your browser: nothing you type or upload leaves your device.

How to use it

  1. Type your domain (optional) and choose the policy: `none` to only get reports, later `quarantine`, and finally `reject`.
  2. Type the addresses that will receive the reports (`rua`, and `ruf` only if you want failure reports). Change the subdomain policy or the alignment only if you have a reason.
  3. Copy the record into a TXT record named `_dmarc`, and have any outside report address publish the `_report._dmarc` record the tool lists.

What a DMARC record does, and what this page builds

DMARC tells receiving servers what to do with mail that shows your domain in the From line but passes neither SPF nor DKIM for it: nothing (p=none), treat it as suspicious (quarantine, usually the spam folder) or refuse it (reject). It also asks them to send you daily aggregate reports, so you see every server that sends as your domain before you block anything. The rules are in RFC 9989, published in May 2026.

This page builds the record on your device and doesn't look up DNS. It writes v=DMARC1 first and the policy right after it, adds only the tags you change and leaves out the defaults, such as relaxed alignment. Each report address is checked and written as a mailto: address. With your domain filled in, the tool shows the full name to publish, _dmarc. plus your domain, and points out report addresses at another domain.

Example: tienda-ejemplo.co from none to quarantine

Start with v=DMARC1; p=none; rua=mailto:dmarc@tienda-ejemplo.co and read the reports for a few weeks, for example with the DMARC report reader. When all your real mail passes, choose quarantine and tick Test mode. The record becomes v=DMARC1; p=quarantine; rua=mailto:dmarc@tienda-ejemplo.co; pct=0; t=y: receivers apply one level lower, none in this case, while you check that nothing legitimate fails. Untick Test mode to enforce it, and move to reject the same way later.

If reports go to a service at another domain, say informes@reportes.example.net, that domain must agree to receive them. The tool shows the TXT record it has to publish, tienda-ejemplo.co._report._dmarc.reportes.example.net with the value v=DMARC1 (RFC 9990, section 4). Without it, receivers don't send those reports.

What changed in 2026, and what DMARC can't do

In May 2026, RFC 9989, 9990 and 9991 replaced RFC 7489, the version most guides still quote. The IANA registry now lists the pct, rf and ri tags as historic, and the new t=y tag is the test mode. Test mode here writes t=y together with pct=0, its old equivalent, so receivers that still follow RFC 7489 do the same thing. Other pct values aren't offered, because receivers applied them inaccurately (RFC 9989, appendix A.6).

DMARC protects your exact domain. It doesn't stop lookalike domains such as tienda-ejemp1o.co, or mail that only puts your company's name in the display name. It also depends on SPF or DKIM passing for your domain, so set those up first. Failure reports (ruf) can contain the headers or the whole message that failed, and many large providers don't send them (RFC 9991).

FAQ

Where do I publish the DMARC record?

As a TXT record at `_dmarc.` followed by your domain, for example `_dmarc.example.com`. Many DNS panels add the domain themselves, so you type only `_dmarc` in the name field; typing the full name there creates `_dmarc.example.com.example.com`.

What is the difference between p=quarantine and p=reject?

With `quarantine`, receivers treat failing mail as suspicious, which usually means the spam folder. With `reject`, they refuse it during delivery and the sender gets a bounce. Both apply only to mail that fails DMARC; mail that passes is delivered as usual.

Is pct still valid?

Since RFC 9989 (May 2026) it is historic: receivers that follow the new standard ignore it, and those that still follow RFC 7489 read it. Only `pct=0` and `pct=100` were applied reliably (RFC 9989, appendix A.6). For testing, use `t=y`; this tool writes `pct=0` next to it for the older receivers.

What do relaxed and strict alignment mean?

Alignment compares the domain in the From line with the domain that SPF or DKIM checked. Relaxed (`r`, the default) accepts a subdomain of the same organization, so `boletin.example.com` aligns with `example.com`. Strict (`s`) needs exactly the same domain. Keep relaxed unless you have a reason to change it.

Does a domain that sends no email need DMARC?

Yes. Publish `v=DMARC1; p=reject`, with an SPF record of `v=spf1 -all`, so receivers refuse mail that claims to come from it. A domain that sends nothing has no real mail to lose.

  • 2.1What's my IP?See your public IP address, whether it's IPv4 or IPv6, your country, TLS and HTTP version, and what every website can learn from your connection.
  • 2.2Email securityCheck a domain's SPF, DKIM, DMARC, MTA-STS, BIMI and DNSSEC, and get copy-ready DNS records for what's missing or wrong.
  • 2.3SPF record builderBuild one SPF record for your domain from your mail services, servers and IP ranges.
  • 2.4DNS lookupLook up any domain's DNS records (A, AAAA, CNAME, MX, TXT, NS, SOA, CAA, SRV) or the reverse DNS of an IP, with TTLs and DNSSEC validation.
  • 2.5Email header analyzerPaste an email's raw headers to see the servers it passed through, the SPF, DKIM and DMARC results your provider recorded, and signs of a forged sender.
  • 2.6DNS propagation checkerAsk 10 public resolvers (Google, Cloudflare, Quad9, OpenDNS…) for a name's A, AAAA, CNAME, MX, NS or TXT records and see if your DNS change reached them.
  • 2.7DMARC report readerOpen a DMARC aggregate report (.xml, .xml.gz or .zip) and see, for each sending IP, how many messages passed or failed SPF and DKIM.
  • 2.8Is it down?Check whether a website answers, with its HTTP status, response time, redirects and HTTPS, measured once from our server in Colombia.
  • 2.10Link preview checkerSee how your link will look when shared on WhatsApp, X, LinkedIn or Facebook: check the title, description, og:image and Twitter card tags, with fixes.
  • 2.11Subnet calculatorType an IP address with its prefix to get the network, mask, broadcast, usable host range and count, and split it into equal subnets.

╌╌ END ╌╌