DMARC

What it checks

The DMARC record and its policy.

Why it matters

DMARC tells receivers to quarantine or reject email that fails SPF and DKIM, which stops spoofing.

How to fix it

1. Publish a DMARC record with p=none and an address for reports.
2. Once the reports show only your own email passing, move to p=quarantine, then p=reject.
3. A domain that sends no email should publish p=reject.

v=DMARC1; p=none; rua=mailto:dmarc@example.com