# DMARC record generator

> Build your domain's DMARC record, from p=none to p=reject, with the report address. Free, right in your browser, with the steps to raise the policy without losing email.

Source: https://couryo.com/en/tools/dmarc-generator · Updated 2026-10-21

## What DMARC is

DMARC is a TXT record at `_dmarc.yourdomain.com` that tells providers what to do when an email with your domain as the sender did **not** pass aligned SPF or DKIM:

- `p=none`: just watch and send me reports;
- `p=quarantine`: send it to spam;
- `p=reject`: refuse it.

Gmail and Yahoo require DMARC from bulk senders since 2024, and Microsoft since May 5, 2025. Besides helping delivery, it stops scammers from using your domain.

## The generator fields

| Field | What it is | Suggestion |
|---|---|---|
| Policy (`p`) | what to do with email that fails | start with `none` |
| Reports (`rua`) | address that gets the providers' daily reports | a mailbox just for this |
| Percentage (`pct`) | how much email the policy applies to | 100, or less while stepping up |
| Subdomains (`sp`) | a different policy for subdomains | same as the main one |
| Alignment (`adkim`, `aspf`) | relaxed accepts subdomains; strict requires the same domain | relaxed |

## Going from p=none to p=reject without losing email

1. **Weeks 1 to 4, `p=none`:** publish the record with `rua` and read the reports. They show every server sending as you, including forgotten services.
2. **Fix whoever fails:** every legitimate service needs DKIM with your domain or aligned SPF. Check with the [SPF, DKIM and DMARC checker](https://couryo.com/en/tools/domain-checker).
3. **`p=quarantine` with `pct=25`:** a quarter of failing email goes to spam. If nothing legitimate suffers, go to 100.
4. **`p=reject`:** fake email in your name is refused. Full protection.

The step by step with examples is in [DMARC from p=none to p=reject](https://couryo.com/en/blog/dmarc-none-quarantine-reject).

## And at Couryo?

DMARC reports arrive as XML, one per provider per day, and almost nobody reads them. At Couryo, your domain's DMARC points the reports to us, the deliverability agent reads them all and tells you in plain words when someone sends as you without authenticating, and when it is safe to raise the policy. See the [deliverability agent](https://couryo.com/en/docs/deliverability.md).

For AI agents, the `generate_dmarc` tool is on Couryo's public MCP server, no login: `https://mcp.couryo.com/tools`.

## FAQ

### Can I start straight at p=reject?

You can, but it is risky: any forgotten legitimate service (the billing system, the website form) gets its email refused. Start with `p=none` and read the reports.

### What is rua for?

It is the address that gets aggregate reports: once a day each provider says how many emails with your domain it saw, from which servers and whether they passed. Without `rua` you never find out.

### What is alignment?

DMARC requires the SPF or DKIM domain to match the sender (the `From`). In relaxed mode a subdomain counts (`bounces.yourdomain.com` aligns with `yourdomain.com`).

### Do I need DMARC if I send no email from the domain?

Yes, with `p=reject`: it is what keeps scammers from using your domain. Pair it with an SPF `v=spf1 -all`.