Build a DMARC record
Fill in the form, copy the record. Nothing is sent anywhere and nothing touches your DNS, this builds text for you to publish yourself.
Judged against RFC 9989 section 4.7
_dmarc.yourcompany.com
TXT
v=DMARC1; p=none; np=reject; rua=mailto:dmarc@yourcompany.com;
p=none reports without protecting. That is the right place to start. Set a reminder to come back in a month.
Before you publish
A generator gives you correct syntax. It cannot know your senders, and syntax was never the hard part. Every record here is easy to write and easy to get subtly wrong in a way that blocks real mail rather than forged mail.
Publish the least strict version first, run the full checkup against your domain, and tighten only once you can see what the change did. If mail is business-critical and you are unsure, that is exactly the sort of thing worth a second opinion.
Questions people actually ask
Does this change my DNS?
No. Nothing here touches your domain, and nothing you type is sent anywhere, the record is built in your browser. You copy it and publish it yourself, which is the only way a tool should ever work.
Where do I paste the record?
Into your DNS provider, as a TXT record, using the host and value shown. Some panels want the host without your domain on the end, and some want it with, if one fails, try the other form.
How long until it works?
As long as the TTL on the record, usually an hour or less for a new one. Check it with the full checkup afterwards rather than assuming.
Should I publish this straight to production?
For reporting-only records, yes. For anything that changes how mail is treated, start with the least strict setting the form offers and tighten once you have seen the reports.
Related tests
Every fix on this site is yours to implement. If you would rather someone did it, I take this work directly.