DMARC checker and record generator.
Read your domain's current policy, then build the exact TXT record that replaces it. No account required.
- Reads the live TXT record at _dmarc and parses every tag
- Shows how much of your mail the policy actually covers
- Ten free checks per day, no account and no stored history
Try a known domain
Results appear here: the raw TXT record, every parsed tag, and what to change. Ten checks per day, no login.
Generator
Build the record, then publish it.
Start at p=none with reporting on, read two weeks of aggregate reports, then move to quarantine or reject.
Set your options above, then generate to see the TXT value.
What each tag does.
Six tags cover almost every production DMARC record.
p=Policy
What receivers do with mail that fails authentication: nothing, quarantine, or reject.
sp=Subdomain policy
Overrides p for subdomains. Omit it and subdomains inherit the main policy.
rua=Aggregate reports
Daily XML summaries of who sent mail as your domain and whether it passed.
ruf=Forensic reports
Per-message failure samples. Many providers no longer send these for privacy reasons.
pct=Rollout percentage
Applies the policy to a share of failing mail. Useful while ramping to reject.
adkim / aspfAlignment mode
Relaxed accepts organizational domain matches; strict requires the exact domain.
Related fix guides
dmarc-alignment-failedDMARC alignment failed: SPF passed
When SPF passes but DMARC fails, the authenticated domain (envelope-from for SPF or d= for DKIM) does not align with the header From domain under your DMARC policy (strict or relaxed). Receivers treat the message as unauthenticated for DMARC purposes.
Read the fix
gmail-unverified-senderGmail unverified sender warning
Gmail shows unverified sender when it cannot verify your domain on the message. Usually missing DMARC, unsigned DKIM, or SPF/DKIM that does not align with the From: address. Marketing and transactional mail from ESPs triggers this most often when only SPF exists on the root domain.
Read the fix
A record you set once still drifts.
ZeroHook re-checks DMARC, SPF, DKIM and DNSSEC every day across every domain you own, and tells you the morning something changes.