What it checks
SPF and DKIM each prove something about a message, but neither looks at the From address. A message can pass SPF for one domain and carry a DKIM signature from another while it shows yours in the From line. DMARC closes that gap. It passes only when SPF or DKIM passes for a domain that matches the From address, which it calls alignment.
Relaxed alignment, the default, accepts any name under the same main domain, so a pass for mail.example.com counts for example.com. Strict alignment, set with aspf=s or adkim=s, needs an exact match. One aligned pass is enough. That's why forwarded mail that fails SPF can still pass DMARC on its DKIM signature.
The record
The record is a TXT record at _dmarc under the domain, like _dmarc.example.com, written as tag and value pairs split by semicolons. It has to start with v=DMARC1. The p tag sets the policy: none only asks for reports, quarantine asks receivers to treat failing mail as suspicious, usually by putting it in spam, and reject asks them to turn it away. The rua tag lists where receivers should send aggregate reports. Without it, nobody sends you any.
RFC 9989 replaced the original spec, RFC 7489, in May 2026. It retired pct, rf and ri, added t=y for testing a stricter policy, and added np for subdomains that don't exist.
Rolling it out
Start with p=none and a rua address, then read the reports. They show every server that sends mail as your domain and whether it passed, which is how you find the services you forgot to add to SPF or DKIM. Once every real sender passes, move to quarantine and later to reject.
Gmail has asked bulk senders, those sending more than 5,000 messages a day to Gmail accounts, for a DMARC record since February 2024. Their policy can stay at p=none.