What is DMARC?
DMARC (RFC 7489) is the layer that makes SPF and DKIM mean something for the address a recipient actually sees. It requires that at least one of the two passes and aligns with the RFC5322.From domain, and it publishes the disposition a receiver should apply when neither does.
Alignment is the whole mechanism
SPF authenticates the envelope domain, DKIM the d= of the signature. Neither is necessarily the domain in the From header — and the From header is the only one the recipient reads. DMARC passes when an SPF or DKIM pass is aligned with it.
Relaxed alignment (the default, aspf=r / adkim=r) requires the organisational domains to match, so a subdomain counts. Strict (s) requires an exact match. Relaxed is the right default for almost everyone; strict breaks the moment a service signs as a subdomain.
The policy tag
p= carries the request to receivers, and it is the only tag that changes what happens to a message.
p=none— take no action, only report. This is a measurement state; it stops nothing.p=quarantine— treat as suspicious, in practice the spam folder. Enforcement, but the message remains reachable.p=reject— refuse in the SMTP transaction. The message is never delivered.
The tags you did not set still apply
sp= absent means subdomains inherit p=. pct= absent means the policy applies to 100% of failing mail; a lower value applies it to a sample and delivers the rest, which is a rollout tool and not a safety setting. adkim/aspf absent means relaxed alignment.
The scan at the bottom of this page prints your record tag by tag, including these defaults, because a default you cannot see is a default you cannot check.
Getting to enforcement safely
Publish p=none with a rua= address, collect aggregate reports for two to four weeks, and read them per source. Move up only when aligned volume is at or above 95% and every remaining failure has an explanation — a broken SPF record, or a receiver reporting the message as forwarded, are both benign; an unidentified source at volume is not.
A rua= on a domain other than your own needs authorisation from that domain: <yourdomain>._report._dmarc.<rua-domain> must exist as a TXT record (§7.1), or conforming receivers send nothing at all.
Frequently asked questions
Is p=none worth publishing at all?
Yes, but only as a step. It buys you the aggregate reports, which are the only view you get of who sends as your domain. It provides no protection: a receiver following p=none delivers the forgery and files a report about it.
Can p=reject block my own mail?
Yes, and that is the whole risk. Any legitimate source that does not produce an aligned SPF or DKIM pass is rejected under p=reject. This is why enforcement follows the reports rather than preceding them.