What it adds
SPF and DKIM each answer a narrow question, and neither says what a receiver should do about a failure. DMARC supplies the missing instruction — ignore, quarantine, or reject — and asks receivers to send you reports about what they saw.
That reporting is the underrated half. Before DMARC you had no idea who was sending mail claiming to be your domain. With it, you get a weekly picture of every server doing so, legitimate or otherwise.
Alignment is the part that trips people up
DMARC does not just require SPF or DKIM to pass. It requires the domain they passed for to match the domain in the From address a human sees. That match is called alignment.
This is why mail sent through a third party can pass SPF and still fail DMARC: SPF passed for the provider's domain, not yours. The fix is to set up DKIM signing with your own domain at that provider, which almost all of them support.
Getting to enforcement safely
Publish p=none with a reporting address and leave it for a few weeks. Read the reports and find every legitimate sender — invoicing systems, marketing tools, ticketing, the CRM nobody remembers setting up.
Fix each one so it aligns, then move to p=quarantine with a percentage, raising it gradually. Only then p=reject.
A domain sitting at p=none for years is not protected. It is watching itself be spoofed and telling receivers to allow it.
Common questions
Does DMARC stop people spoofing my domain?
At p=reject, yes — receivers honouring DMARC will refuse mail that fails. At p=none it stops nothing; it only reports. The policy is what does the work.
What is DMARC alignment?
Alignment requires that the domain which passed SPF or DKIM matches the domain in the visible From address. Mail can pass SPF and still fail DMARC if it passed for a third party's domain rather than yours.
Will DMARC break my existing email?
Not at p=none, which changes nothing about delivery. It can at quarantine or reject if a legitimate sender is not aligned — which is exactly why you start at none and read the reports first.