What Is DMARC? A Beginner’s Guide to DMARC Policies
DMARC tells receiving mail servers what to do when a message claiming to be from your domain fails SPF and DKIM checks. It also sends you reports about who is sending email as you.
Where DMARC lives
DMARC is a TXT record at _dmarc.yourdomain.com. It always starts with v=DMARC1 and includes a policy tag, p=.
v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain.com
The three policies
p=none only monitors. Nothing is blocked, so it offers no protection on its own.
p=quarantine asks receivers to send failing mail to spam.
p=reject asks receivers to refuse failing mail outright. This is the goal.
A safe rollout
Start with p=none and a rua= address so you receive reports. Once every legitimate sender passes SPF or DKIM, move to quarantine, then reject. The pct= tag lets you apply a policy to only part of your mail while you test, but anything below 100 is not full protection.
Check your record
A DomainGuard audit flags missing, duplicate or monitor-only DMARC records and explains what to change.