What DMARC adds
A DMARC record is a TXT entry at _dmarc.yourdomain.com. It requires that SPF or DKIM pass and align with the domain in the visible From address. It then states a policy and an address for reports. Large mailbox providers increasingly expect senders to have it, especially for bulk mail.
The three policies
The p tag sets the policy. none means monitor only and take no action. quarantine asks receivers to treat failing mail as suspicious, often routing it to spam. reject asks them to refuse it. Most businesses should start with none, learn from the reports, and move up gradually.
A starter record might be: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com. The rua address receives summary reports in a machine-readable form.
Reading the reports
Raw reports are XML files that few people want to read. Free and low-cost services will collect them and show a dashboard of which sources send as your domain and whether they pass. Look for legitimate senders that fail, such as a billing platform with no DKIM setup, and fix them first.
Unknown sources that fail are worth attention. They may be spoofers or old tools.
Moving toward enforcement
Once all legitimate sources pass for a few weeks, move to quarantine. Some owners use the pct tag to apply it to a portion of mail at first. Watch for complaints that real messages are missing. After a stable period, reject offers the strongest protection against others impersonating you.
Do not rush. Jumping straight to reject without checking your senders can send real invoices and quotes to the trash.
Avoid these mistakes
Do not publish more than one DMARC record. Make sure SPF and DKIM are working before you add it. Subdomains can have their own policy through the sp tag. If you send mail from subdomains, include them in your review.
Mailbox providers and registrars have guides for adding the record. If email is mission critical and you are uneasy, ask your IT person or web provider to check the setup before enforcement.
Who should be involved
If someone else manages your email, such as an IT provider or a web agency, tell them before you publish DMARC. They know which systems send mail for you and can spot gaps quickly. Also tell the people in your office who send newsletters or invoices from other tools.
Keep a document that lists every sender, the date it was verified, and who owns the account. When you change tools, update the list and the DNS records together. This turns DMARC from a one-time project into an ordinary habit.
Plan a review every quarter. Check the reports for new unknown sources, confirm that your policy is still what you intended, and make sure the report mailbox is monitored. A report address that bounces or fills up means you stop seeing what is happening to your domain.
Common questions
Is p=none useful by itself?
It gives visibility through reports, which is valuable. It does not block spoofed mail until you move to quarantine or reject.
Do small businesses really need DMARC?
It is a sensible protection, and some large receivers now require it for senders who email in volume.
How long should I stay at monitoring?
Often a few weeks, long enough to see all your regular senders including monthly or seasonal ones.
This guide is general information. Search engines change how they work and their guidelines; check Google's current documentation for your situation. Nobody can guarantee a ranking.