DMARC DNS Generator

THE PRACTICAL GUIDE · NORMANDIN SYSTEMS

Get more from DMARC DNS Generator

DMARC DNS Generator: Generate DMARC DNS TXT record. DMARC expresses how a domain owner wants receivers to handle authentication alignment failures and where supported reports should be sent. DNS records are configuration data that must be published in the correct zone with the right owner name, type, and value. A generator helps assemble a record, but publication and effective behavior depend on the authoritative DNS service and any systems consuming it. Keep the record’s name separate from its value when transferring it to a provider interface. After a change, query the authoritative answer and allow for cached responses to expire. Record the previous value so that a mistaken configuration can be restored deliberately.

Guide updated October 13, 2026

How to use this tool

1. Begin with a representative input. For a practical test, use: Domain example.com with monitoring policy p=none. Replace demonstration values only after you understand the output.
2. Fill in the domain and purpose-specific fields using the values supplied by the service or system that will consume the record.
3. Review the generated record name, record type, and value separately. Check for duplicated domain suffixes and accidental quotation marks.
4. Publish through your DNS management system, then verify the authoritative response and the relevant application’s behavior.

SEE IT IN PRACTICE

A worked example

Domain: example.com
Policy: none

Name: _dmarc.example.com
Type: TXT
Value: v=DMARC1; p=none;

This is a monitoring policy rather than a request to quarantine or reject failures. Add only reporting destinations you control and understand; the minimal record above does not request report delivery.

Build an email-authentication picture

A domain may send through several services, each with its own configuration. Inventory those sources before tightening policy. SPF authorization, DKIM selector publication, and DMARC alignment are related but separate tasks. A message can pass an individual authentication mechanism without satisfying DMARC alignment. BIMI adds brand-indicator information under its own requirements and does not replace the authentication foundation.

Use observations to guide a rollout

Publish records in the correct owner names, then verify authoritative DNS and actual message results. Aggregate DMARC reports provide a receiver-specific view over a time window, useful for identifying legitimate and unexpected sources. Interpret counts and failures in context before moving from monitoring to enforcement. A syntactically valid record or a clean report from one receiver is not proof that every legitimate sender is correctly configured.

When this tool is useful

• Draft a monitoring record
• Review DMARC policy tags
• Document mail-authentication rollout

Tips for a better result

• A monitoring policy does not request rejection; review legitimate senders before changing to an enforcement policy.
• DNS control panels vary: some expect a relative owner name, while others expect a fully qualified domain name.
• Do not confuse generating a record with publishing it; a value on this page has no effect until it is installed in the correct zone.

Frequently asked questions