DMARC
A DNS policy telling inboxes what to do with mail using your domain in the From line when neither SPF nor DKIM passes in an aligned way.
See it
What it is
DMARC sits on top of SPF and DKIM and answers the question neither of them does: what should a receiver do when mail using your domain in the From line has no aligned pass? A message fails DMARC when neither SPF nor DKIM produced a pass for a domain matching the visible From, which is not the same as both checks failing. SPF can pass for your provider's envelope domain, or DKIM can pass with the vendor's 'd=', and DMARC still fails because nothing lined up with what the reader sees. You publish a TXT record at '_dmarc.yourdomain.com' with a policy of p=none (watch only), p=quarantine (junk it), or p=reject (refuse it at the door), plus an 'rua' address that collects aggregate XML reports from the receivers that send them.
Reach for it the moment your domain matters, and know that Gmail and Yahoo have required at least a DMARC record from bulk senders since 2024. The sane rollout is staged: publish p=none, read aggregate reports for two to four weeks until you recognize every legitimate sender, move to quarantine with a low 'pct', then reject.
Two things bite people. First, p=none forever is monitoring dressed up as compliance; it protects nobody. Second, enforcement breaks the senders you forgot: the CRM, the invoicing tool, the intern's newsletter app. Scope is worth getting right too. A policy on your organizational domain applies to its subdomains as well, unless you set an 'sp=' tag for them or publish a DMARC record directly on a subdomain, which takes precedence. What it can never touch is a lookalike domain: a record on example.com has no say over exampl3.com.
Ask AI for it
Write a staged DMARC rollout for example.com, which sends through Google Workspace, Amazon SES, and HubSpot. Give me four exact TXT records for '_dmarc.example.com': stage 1 monitoring ('v=DMARC1; p=none; rua=mailto:dmarc@example.com; fo=1'), stage 2 quarantine at pct=25, stage 3 quarantine at pct=100, stage 4 p=reject. For each stage state how long to hold it, what to look for in the aggregate reports before advancing, and the specific failure patterns (forwarders, unaligned vendors) that mean stop and fix rather than advance. Judge every stage on aligned passes, not on raw SPF or DKIM results, since a vendor can pass one of those and still fail DMARC. Note the sp tag choice for subdomains and what changes if a subdomain publishes its own DMARC record.