Start with p=none and a rua= reporting address. After a week of reports showing your mail aligned and passing, move to p=quarantine, then p=reject. Never go straight to reject on a domain you have not monitored.
What DMARC adds
SPF and DKIM each say whether a message passed. DMARC says what to do when they fail, and requires that the passing one aligns with the visible From domain. Without DMARC, a passing DKIM signature from any domain is enough; with it, the signature has to be yours.
The record
_dmarc.try-acme.com TXT "v=DMARC1; p=none; rua=mailto:dmarc@try-acme.com; adkim=r; aspf=r"Use a real mailbox or a DMARC report service for rua. Reports arrive as XML; a free parser makes them readable.
Moving up
- p=none for one to two weeks. Read the reports. Every legitimate source should show SPF or DKIM aligned.
- p=quarantine; pct=25. Failing mail from a quarter of receivers goes to spam. Watch for drops in legitimate delivery.
- p=quarantine at 100%, then p=reject.
For a dedicated sending domain with one provider, the whole path takes three weeks. Run the domain check after each step.
Live SPF, DKIM, DMARC and MX lookup with raw records and plain-English fixes.
Questions
Does p=none protect me?
No. It only reports. But it satisfies the minimum bulk sender requirement and gives you the data to move up safely.
What is relaxed alignment?
adkim=r and aspf=r allow subdomains to align with the organisational domain. It is the right default unless you have a specific reason to be strict.