Glossary · Authentication
DMARC tells receivers what to do with email that fails SPF and DKIM for your domain, and sends you reports about who is sending as you.
DMARC (RFC 7489) is a TXT record at _dmarc.yourdomain. A message passes DMARC when SPF or DKIM passes for a domain that aligns with the From address people see. That link to the visible sender is what SPF and DKIM lack on their own.
The p= tag sets the policy for mail that fails: none (monitor only), quarantine (treat as spam) or reject (refuse). The rua= tag asks receivers for daily aggregate reports showing every server that sent mail using your domain.
The usual path is to start at p=none with reports, fix every legitimate service the reports show failing, then move to quarantine and finally reject. Only an enforced policy stops spoofing.
v=DMARC1; p=none; rua=mailto:dmarc-reports@acme.comEvery domain you run in one inbox, from $3 a mailbox. 14 days free, no card.