What DMARC decides
SPF and DKIM each prove something about a domain, but neither looks at the address in the From line, which is the one people read. DMARC ties them to it. A message passes DMARC when SPF or DKIM passes for a domain that matches the From domain, and the record tells receivers what to do with a message that does not.
The record lives in DNS as a TXT record at _dmarc followed by your domain. When that name has no record, receivers look up the organisational domain instead (the registered domain, example.com for news.example.com), which is why a subdomain can be covered without a record of its own.
Reading the policy
p=none asks receivers to do nothing and only send reports. It is where everybody should start, and where far too many domains stay for years. While it is in place, anybody can send mail with your domain in the From line and the receiver has been told to let it through.
p=quarantine sends failing mail to spam, p=reject refuses it at the door. Gmail and Yahoo have required bulk senders to publish a DMARC record since February 2024. A record with p=none meets that requirement on paper, and the checker still marks it as a warning.
Reports that never arrive
The rua addresses get an aggregate report from each receiver that sees your mail, once a day by default. If an address sits on a different domain from the one the record is for, RFC 7489 requires that other domain to publish an authorisation record saying it accepts reports for yours. For every external address the checker looks that record up. Without it, receivers drop the reports.
Questions
How do I add a DMARC record?
Publish a TXT record at _dmarc followed by your domain, with v=DMARC1 and a policy, for example v=DMARC1; p=none; rua=mailto:dmarc@example.com. Start at p=none, read the reports for a few weeks, then move to quarantine and later to reject. Check the record here once DNS has picked it up.
Is p=none bad?
As a first step it does its job: it collects reports without affecting delivery, and that is how you find the services sending for you that are not yet authenticated. It becomes a problem when it stays, since the point of the reports is to get you to quarantine and then reject.
Do I need a separate record for each subdomain?
A subdomain without its own record falls back to the record of the organisational domain, and the sp tag in that record sets the policy for subdomains. So one record usually covers them all.
Relaxed or strict alignment?
Relaxed, unless you have a reason. With relaxed alignment a DKIM signature from mail.example.com counts for From addresses at example.com. Strict breaks that, and with it a lot of setups where a provider signs with a subdomain.
What does "DMARC policy not enabled" mean?
It means the domain's DMARC record says p=none, or that the domain has no DMARC record at all. With p=none receivers deliver failing mail as usual and only send reports to the rua address, so nobody is stopped from sending as your domain yet.
Full guide: DMARC policy not enabled
Can a domain have more than one DMARC record?
No. When _dmarc holds two TXT records that start with v=DMARC1, receivers discard both and treat the domain as having none. Keep one and move the tags you need from the other into it.
Quarantine or reject?
Quarantine first. Receivers treat failing mail as suspicious, usually by putting it in spam, so a legitimate service you missed costs a folder rather than a lost message. Move to reject when the reports have shown nothing of yours failing for a few weeks.