@NullBounce
Log In
Sign Up Free
🛠️ Free DNS Configuration Builder

Free DMARC Record Generator

Create a compliant DMARC TXT record for your domain in seconds. Meet Google & Yahoo 2024+ sender requirements, prevent domain spoofing, and safeguard inbox deliverability.

Configure DMARC Record

RFC 9989 Ready

Parameters update the generated DNS string in real time.

Policy presets:

Enter your root domain (e.g. company.com, without http or subdomains).

2. DMARC Enforcement Policy (p=)

Mailbox providers will send daily XML reports to this address. The mailto: scheme is appended automatically.

Enable DMARC Policy Test Mode (t=y) RFC 9989

Replaces the legacy pct= tag. t=y marks the policy as under test. Receivers that support RFC 9989 report failures but don’t apply the policy. Receivers that don’t support it yet ignore the tag and enforce p= normally. Use p=none for monitoring that works everywhere.

Generated DNS Record
Type: TXT
Host / Name:
_dmarc
TXT Value:
v=DMARC1; p=none
Audit domain in Email Authentication Checker →

How to Add DMARC to Your DNS Host

Select your DNS manager below for step-by-step instructions:

  1. Log in to your Cloudflare Dashboard and select your domain.
  2. Navigate to DNS → Records and click Add record.
  3. Set Type to TXT.
  4. Set Name to _dmarc.
  5. Paste the generated string into the Content field. Set TTL to Auto and click Save.
Finished adding to DNS? Wait 2–5 minutes for DNS propagation, then verify: Run Instant DNS Audit →
Protocol Primer

What Is DMARC and Why Is It Mandatory?

DMARC (Domain-based Message Authentication, Reporting, and Conformance) is the security bridge that connects SPF and DKIM authentication to your visible email address.

Anti-Spoofing

Stops Domain Impersonation

Without DMARC, anyone can send an email with your domain in the visible From: header. DMARC tells mail servers to block unauthorized impostors.

Protects brand reputation
Google & Yahoo

Mandatory Deliverability Rule

Google and Yahoo enforce strict DMARC publication rules for all bulk and outreach senders. Senders without a published DMARC record suffer immediate spam-folder relegation.

Prerequisite for primary inbox
Reporting

Visibility into Shadow Senders

Aggregate XML reports (rua) reveal every third-party service (SendGrid, Mailchimp, HubSpot, Zendesk) sending email on behalf of your brand.

Daily aggregate XML logs
Implementation Strategy

The 3-Stage Roadmap from p=none to p=reject

Never start directly with p=reject on an active production domain without monitoring first:

01

Stage 1: Monitoring Mode (p=none)

Start with p=none for 2–4 weeks. Monitor your aggregate reports to identify all legitimate sending services (CRM, billing, marketing) and verify their SPF and DKIM alignments.

Discovery Phase
02

Stage 2: Quarantine Mode (p=quarantine)

Once all legitimate tools are authenticated, switch to p=quarantine. Unauthenticated messages are relegated to the spam folder rather than delivered to primary inboxes.

Containment Phase
03

Stage 3: Full Enforcement (p=reject)

The ultimate security milestone. Any message that fails SPF and DKIM alignment is rejected completely before reaching the user's mailbox. Your domain cannot be spoofed.

Full Protection
The Missing Deliverability Link

DMARC Protects Your Domain. NullBounce Protects Your Bounce Rate.

Having a compliant DMARC record guarantees that other mail servers know you are a verified sender. However, it does not stop emails from bouncing if your recipient list is dirty.

If your outbound outreach bounces on > 2% of contacts, Google and Microsoft spam filters will penalize your sender score regardless of how strict your DMARC policy is.

Clean your prospect databases before hitting send. Verify mailboxes, detect burner domains, and isolate accept-all servers with NullBounce.

Claim 100 free verification credits upon sign-up.Verify First 100 Emails Free →

DMARC Generator: Frequently Asked Questions

Practical answers about DMARC records, syntax, and email deliverability.

Where do I publish my generated DMARC record?

You must publish it as a TXT record in your domain's DNS manager (where your domain is hosted, such as Cloudflare, GoDaddy, or Namecheap). The Host/Name must always be _dmarc.

Why must the report email start with "mailto:"?

RFC 7489 / RFC 9989 specifications require reporting endpoints in the rua and ruf tags to be valid URIs. Entering just an email address (e.g. dmarc@domain.com) is a syntax error and will cause mail servers to ignore your reporting requests.

Can I have more than one DMARC record on a single domain?

No. A domain must publish strictly one DMARC record at _dmarc. If receiving servers find multiple DMARC records, they abort DMARC evaluation completely.

How do I verify that my DMARC record is working?

After publishing the TXT record in your DNS, wait 2–5 minutes for propagation, then test your domain in our free Email Authentication Checker to verify policy status and Google/Yahoo compliance.

Protect Your Domain. Clean Your Outreach Lists.

Combine enterprise DNS authentication with verified clean email databases. Start testing your prospect lists today with 100 free credits.

Verify 100 Contacts Free →