What is DMARC?
DMARC connects visible Header From with SPF and DKIM alignment, then publishes handling and reporting guidance.
Policy
p=none monitors, p=quarantine asks receivers to treat failing mail as suspicious, and p=reject asks compliant receivers to reject it. The receiver makes the final decision.
Control tags
sp controls subdomains; pct rolls policy out; rua receives aggregate reports; ruf receives failure reports; aspf and adkim select relaxed or strict alignment.
Safe rollout
Inventory legitimate senders, publish p=none, analyze reports, fix alignment, then increase pct and enforce gradually.