Free tool
Build a DMARC record tag by tag, with each choice explained in the terms that decide what receivers do with your mail. The record is generated by the same code our checker validates against, so what you publish is what it will approve of.
p=none — watch. Nothing changes for your mail. Reports start arriving at the rua address, and they will show senders you had forgotten: a ticketing system, a payroll tool, a form on an old site. p=quarantine — spam folder. Once every legitimate sender appears in the reports with SPF or DKIM aligned. pct is how you ramp into it. p=reject — refused at the door. The end state, and the one that actually stops your domain being used for phishing. p — the policy for the domain itself.sp — the policy for subdomains. Leave it unset and subdomains inherit p, which is normally what you want; setting it to none under an enforcing policy leaves every subdomain forgeable. rua — where daily aggregate reports go. Without it the policy still works and you are blind. adkim / aspf — how exactly the authenticated domain must match the one in From. An rua address on a domain other than the one the policy is for only works if that domain publishes an authorisation record — yourdomain._report._dmarc.theirdomain containing v=DMARC1. Without it, receivers that follow the specification send nothing at all, which looks exactly like DMARC not working. The DMARC checker tests for it.
DNS takes a few minutes to a few hours to propagate. Then run the record through the DMARC checker — it reads what is actually being served, which is not always what the panel shows — and check the whole setup with the full report.
p=none with an rua address. It changes nothing about your mail and starts the flow of reports that tells you who sends as your domain. Two weeks of those, then quarantine, then reject.
At _dmarc.yourdomain, as a TXT record — not at the domain itself. A DMARC record published at the apex is just another TXT record nobody reads, and it is the single most common way a generated record ends up doing nothing.
Usually not. Failure reports contain parts of individual messages, most large providers do not send them at all for privacy reasons, and the ones that do can be a firehose. Aggregate reports (rua) are where the information is.
It applies the policy to a percentage of failing mail and delivers the rest as if there were no policy. It is a ramp for moving to quarantine or reject without risking everything at once — and a value left below 100 quietly exempts most of your traffic.
Relaxed, unless you know why you want strict. Relaxed counts a subdomain as aligned, which is what makes a sending subdomain and a separate bounce domain work. Strict requires an exact match and is the usual cause of a sudden DMARC failure after a change nobody connected to email.