SPF publishes a list of servers allowed to send as your domain. DKIM signs each message with a key whose public half is in your DNS. DMARC is the policy layer on top that says what to do when neither passes, and where to send reports about it.
The part that catches people is alignment. SPF can pass for your sending platform's bounce domain while your From header says your own company. That is a pass and it aligns with nothing, so DMARC fails. Alignment means the authenticated domain matches the visible one.
The order matters. Get SPF and DKIM working first, with at least one of them aligned to your own domain. Then publish DMARC at p=none, which asks receivers to report and take no action. Then read the reports for two weeks before touching anything.
Only then raise the policy, in steps. Quarantine with a small percentage, watch, increase, then reject. Every step that gets skipped is a chance to block your own mail.
The record itself, decoded
v=DMARC1 identifies the record. p= is the policy: none, quarantine or reject. rua= is where aggregate reports go, and it is the only reason to publish a record at all in the first weeks.
pct= applies the policy to a percentage of failing mail, which is how you raise a policy without betting everything on it working.
aspf= and adkim= set alignment mode. Relaxed accepts any subdomain of your organizational domain and is what almost everyone wants. Strict requires an exact match.
Publish it at _dmarc.yourdomain.com, not at the root. A record on the root looks published, every checker says missing, and nobody spots the difference.
Where this argument costs us something
The short version
- Fix SPF and DKIM alignment before publishing any DMARC policy.
- Start at p=none and read the reports for two weeks.
- Prefer aligning DKIM, because it survives forwarding and SPF does not.
Questions people ask
Why does DMARC fail when SPF passes?
Alignment. SPF passed for your platform's bounce domain, which is not the domain in your From header. DMARC requires the authenticated domain to match the visible one.
Is p=reject the goal?
Eventually. It is the only policy that stops exact-domain spoofing at receivers who honor it. Getting there requires every legitimate source passing first.