Help: DMARC explained

The short version

SPF and DKIM each produce a result and neither decides anything. DMARC is the instruction: it says what a receiver should do with mail that fails, and asks receivers to report what they saw. It is published as a text record at _dmarc.yourdomain.com.

v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain.com; sp=quarantine

Alignment - the part that makes it work

A message carries two domains. There is the address the reader sees in the From line, and there is the domain that actually authenticated - the one SPF checked, or the one that signed with DKIM. Nothing before DMARC required those two to be the same domain.

The address a reader sees and the domain that authenticated are separate fields. Forgery is the gap between them, and alignment is the rule that closes it.

Alignment is that rule: SPF or DKIM must pass for the domain in the From line. A forger can trivially pass SPF for a domain they own; they cannot pass it aligned to yours.

The policy, and the three answers

p=none: Do nothing - deliver as normal, and report if asked. This blocks no forgery at all. It is a good place to start and a bad place to stop.
p=quarantine: Treat failing mail as suspicious. In practice, the spam folder.
p=reject: Refuse it outright. The forged message never reaches the recipient.

Two other tags decide how much your policy really covers: sp= sets the policy for your subdomains, and pct= sets the proportion of failing mail it is applied to. p=reject with sp=none protects the domain and leaves every subdomain open. See subdomain policy and rollout.

The reporting address is the whole point

rua= asks receiving providers to send you a daily report naming every server that sent mail claiming to be your domain and whether each passed. Without it, receivers still enforce your policy and nobody tells you anything - you cannot see a phishing campaign in your name, and you have no evidence on which to decide whether enforcement is safe.

Adding it changes no delivery decision, so it cannot break your mail. It is the highest value, lowest risk change available to most domains.

Getting to enforcement without breaking your mail

Publish p=none with a reporting address. Nothing about delivery changes.
Read the reports until you can account for every legitimate sender, and fix each one so it passes SPF or DKIM aligned to your domain.
Move to p=quarantine. Watch for anything unexpected landing in spam.
Move to p=reject.

The middle step is the one people skip, and it is the only one that tells you whether the next move is safe. Going straight to reject stops any legitimate sender that is not authenticating properly - and you find out from the customer who never received the invoice.

What DMARC does not stop

DMARC governs your exact domain. Three things look like you and are outside it entirely:

One of these four is stopped by DMARC. The other three are not.

A lookalike domain: A different domain registered to resemble yours. It is not your domain, so nothing you publish for yours governs it.
A spoofed display name: Your company name in front of an address that is not yours. The name is what most people read; the address is what is checked.
A compromised mailbox: Genuinely authenticated mail, because the attacker is signed in as a real user. It passes every check by design.