Rolling out a DMARC policy
DMARC ties SPF and DKIM together. It tells receivers what to do when a message fails both, and it gives you reports about who is sending mail as your domain. Without it, receivers are left guessing and you never find out that someone is spoofing you.
Start in monitoring mode
This changes nothing about delivery. It only starts the reports arriving, which is the whole point of the first step.
_dmarc.example.com. TXT "v=DMARC1; p=none; rua=mailto:[email protected]"Leave it for a few weeks and read what comes back. The reports are XML, so use one of the free viewers rather than opening them by hand. You are looking for legitimate senders that fail, and there is nearly always one nobody remembered: a ticket system, a CRM, an old newsletter tool.
p=none protects nobody
Monitoring mode is a useful first step, but if you leave it there forever then anyone can still send mail as your domain and receivers will accept it. The point of p=none is to be temporary.
Then tighten it
Once the reports show only your own systems passing, move up. Quarantine sends failures to spam, reject refuses them outright.
_dmarc.example.com. TXT "v=DMARC1; p=quarantine; rua=mailto:[email protected]"
# and once that is quiet too
_dmarc.example.com. TXT "v=DMARC1; p=reject; rua=mailto:[email protected]"Two tags worth knowing
pct= applies the policy to only a share of failing mail, which is handy while rolling out and very easy to leave behind by accident. sp= sets the policy for subdomains, and if you leave that at none while your main domain is on reject, then anything.example.com is still wide open to spoofing.
Do this last, after SPF and DKIM are already correct. A strict policy published first blocks your own mail.