Skip to content
couryo

Free tools

DMARC record generator

Build your domain's DMARC record, from p=none to p=reject, with the report address. Free, right in your browser, with the steps to raise the policy without losing email.

Free, no sign-up

A mailbox just for this: daily XML reports arrive there.

How much email the policy applies to. Use less than 100 while stepping up.

Your record

Type TXT · Name
_dmarc.yourdomain.com
Value
v=DMARC1; p=none

A good start. Read the reports for a few weeks and, once every legitimate email passes, move to quarantine.

Without rua you get no reports and never find out who is sending as you.

Also by API and MCP

No key needed, with a daily limit per IP. A free Couryo account raises the limit. Free tools docs · MCP: https://mcp.couryo.com/tools

View as Markdown

What DMARC is#

DMARC is a TXT record at _dmarc.yourdomain.com that tells providers what to do when an email with your domain as the sender did not pass aligned SPF or DKIM:

Gmail and Yahoo require DMARC from bulk senders since 2024, and Microsoft since May 5, 2025. Besides helping delivery, it stops scammers from using your domain.

The generator fields#

Field What it is Suggestion
Policy (p) what to do with email that fails start with none
Reports (rua) address that gets the providers' daily reports a mailbox just for this
Percentage (pct) how much email the policy applies to 100, or less while stepping up
Subdomains (sp) a different policy for subdomains same as the main one
Alignment (adkim, aspf) relaxed accepts subdomains; strict requires the same domain relaxed

Going from p=none to p=reject without losing email#

  1. Weeks 1 to 4, p=none: publish the record with rua and read the reports. They show every server sending as you, including forgotten services.
  2. Fix whoever fails: every legitimate service needs DKIM with your domain or aligned SPF. Check with the SPF, DKIM and DMARC checker.
  3. p=quarantine with pct=25: a quarter of failing email goes to spam. If nothing legitimate suffers, go to 100.
  4. p=reject: fake email in your name is refused. Full protection.

The step by step with examples is in DMARC from p=none to p=reject.

And at Couryo?#

DMARC reports arrive as XML, one per provider per day, and almost nobody reads them. At Couryo, your domain's DMARC points the reports to us, the deliverability agent reads them all and tells you in plain words when someone sends as you without authenticating, and when it is safe to raise the policy. See the deliverability agent.

For AI agents, the generate_dmarc tool is on Couryo's public MCP server, no login: https://mcp.couryo.com/tools.

FAQ#

Can I start straight at p=reject?#

You can, but it is risky: any forgotten legitimate service (the billing system, the website form) gets its email refused. Start with p=none and read the reports.

What is rua for?#

It is the address that gets aggregate reports: once a day each provider says how many emails with your domain it saw, from which servers and whether they passed. Without rua you never find out.

What is alignment?#

DMARC requires the SPF or DKIM domain to match the sender (the From). In relaxed mode a subdomain counts (bounces.yourdomain.com aligns with yourdomain.com).

Do I need DMARC if I send no email from the domain?#

Yes, with p=reject: it is what keeps scammers from using your domain. Pair it with an SPF v=spf1 -all.