DMARC (Domain-based Message Authentication, Reporting and Conformance) is a DNS policy that tells receiving servers what to do with mail claiming to be from your domain when it fails authentication — deliver it, quarantine it, or reject it — and where to send reports about it.
How it works
You publish a TXT record at _dmarc.yourdomain. A message passes DMARC when SPF or DKIM passes and the domain that passed aligns with the domain in the visible From address. That alignment is the part SPF and DKIM cannot do alone, and it is what finally stops someone putting your domain in the From line. The standard is RFC 7489.
The three policies
p=none— monitor only. Nothing is blocked; you receive reports showing who is sending as your domain. The right place to start.p=quarantine— mail that fails is treated as suspicious, usually delivered to spam.p=reject— mail that fails is refused outright. The goal.
The rua= tag names an address for daily aggregate reports. Those reports are how you discover the forgotten newsletter tool sending as your domain before a strict policy starts rejecting its mail.
How to check yours
dig +short TXT _dmarc.yourdomain.comDMARC at Mailotte
mailotte.com publishes p=reject, the strictest policy: mail forged as mailotte.com is refused, not quarantined. When you connect your own domain, Mailotte asks you to start at p=none with reports enabled — monitoring first, so nothing you rely on is rejected while you find out what else sends as your domain. Move to quarantine and then reject once the reports are clean.
Questions
Should I start with p=reject?
Only if you are certain every service that sends as your domain is covered by SPF or DKIM. Otherwise start at p=none, read the reports, fix what they show, then tighten.
What is DMARC alignment?
The requirement that the domain which passed SPF or DKIM matches the domain in the visible From address. It is what stops a message signed by a scammer's domain from passing as yours.
Do I need DMARC if I have SPF and DKIM?
Yes. Without it, nothing connects those checks to the From address people actually read, and receivers have no instruction for mail that fails.