Is p=none worth publishing?

Yes, as a first step. It changes nothing for delivery but starts the reports you need before enforcing. It is not a destination; move to quarantine and then reject.

Will DMARC reject block my own email?

Only mail that fails both aligned SPF and aligned DKIM. If every service you send from is configured to sign with your domain (DKIM) or use your domain in the Return-Path (SPF), legitimate mail passes.

What are DMARC aggregate reports?

XML summaries that receivers send daily to the rua address, listing sending IPs, message counts and SPF/DKIM/DMARC results. They are how you discover unaligned senders and spoofing attempts.

Do I need DMARC if I have SPF and DKIM?

Yes. Without DMARC, receivers have no instruction to act on SPF or DKIM failures, and the visible From domain is not protected.

What is DMARC?

DMARC (Domain-based Message Authentication, Reporting and Conformance) is a DNS TXT record at _dmarc.<domain> that does two things. It publishes a policy telling receivers what to do with mail that fails authentication (deliver, quarantine or reject), and it asks them to send you reports about every message that claimed to come from your domain.

DMARC is the piece that turns SPF and DKIM from advisory checks into enforcement. Without it, a message can fail both and still land in the inbox.

What a DMARC record looks like

Example record

Name: _dmarc.example.com
Type: TXT
Value: v=DMARC1; p=reject; rua=mailto:dmarc@example.com; adkim=s; aspf=s

p= — the policy for the domain: none (report only), quarantine (send to spam) or reject (refuse).
sp= — the policy for subdomains; defaults to the same as p.
rua= — where aggregate (daily summary) reports go.
ruf= — where forensic (per-message) reports go; few receivers send them.
adkim= and aspf= — alignment mode, r (relaxed, organisational domain) or s (strict, exact match).
pct= — percentage of failing mail the policy applies to; use it only during rollout.

Alignment: why SPF or DKIM passing is not enough

DMARC passes when at least one of SPF or DKIM passes and is aligned: the domain that passed must match the domain in the visible From header. SPF checks the Return-Path domain; DKIM checks the d= signing domain. A newsletter service that uses its own Return-Path and signs with its own domain will pass both checks and still fail DMARC.

DKIM alignment is the one to get right first, because it survives forwarding. Configure each sending service to sign with your domain.

A safe rollout order

Publish p=none with an rua address. Nothing changes for your mail; reports start arriving.
Read the reports for two to four weeks. Fix every legitimate sender that is not aligned (enable DKIM, add SPF includes).
Move to p=quarantine, optionally with pct=25 then 100.
Move to p=reject. This is the goal: spoofed mail is refused outright.
Keep the rua address monitored; new tools that send email will show up there first.

Domains that do not send email

Parked domains, brand variants and typo domains are favourite spoofing targets because nobody watches them. Lock them down with a null MX (0 .), an SPF record of v=spf1 -all, and DMARC p=reject; sp=reject. This is safe immediately because there is no legitimate mail to break.

Frequently asked questions

Is p=none worth publishing?: Yes, as a first step. It changes nothing for delivery but starts the reports you need before enforcing. It is not a destination; move to quarantine and then reject.
Will DMARC reject block my own email?: Only mail that fails both aligned SPF and aligned DKIM. If every service you send from is configured to sign with your domain (DKIM) or use your domain in the Return-Path (SPF), legitimate mail passes.
What are DMARC aggregate reports?: XML summaries that receivers send daily to the rua address, listing sending IPs, message counts and SPF/DKIM/DMARC results. They are how you discover unaligned senders and spoofing attempts.
Do I need DMARC if I have SPF and DKIM?: Yes. Without DMARC, receivers have no instruction to act on SPF or DKIM failures, and the visible From domain is not protected.

Check your own domain. The scan shows your live records, a score out of 100 and the exact record to publish for each fix.