DMARC (Domain-based Message Authentication, Reporting and Conformance) is the DNS policy that tells receiving mail servers what to do with emails that fail SPF or DKIM authentication. It has three enforcement levels: p=none (monitor — do nothing with failing emails, but send me reports), p=quarantine (send failing emails to spam), and p=reject (block failing emails from delivery). DMARC also introduces alignment — the From domain in the email header must match the domain that passed SPF or DKIM, closing the loophole where an attacker could pass SPF on one domain while spoofing the From address with yours. The reporting feature of DMARC is underused by creators. When you set up DMARC with a rua (aggregate reports) email address, receiving ISPs send you daily XML reports showing every IP that attempted to send mail using your domain, whether they passed SPF and DKIM, and how many messages were sent. This gives you two things: early warning if someone is spoofing your domain to send phishing or spam (which will show up as failures from IPs you don't recognize), and confirmation that all your legitimate sending sources (your ESP, any transactional email service, automated reply systems) are properly authenticated. The safe implementation path: start with p=none and a rua tag pointed at a DMARC reporting mailbox. Review the reports for 2–4 weeks to confirm all your legitimate email sources pass authentication. Once you see consistent DMARC pass rates above 95%, move to p=quarantine with pct=25 (apply policy to 25% of failing mail) and gradually increase. Move to p=reject only when you're confident all legitimate sending is authenticated and passing. Jumping to p=reject before auditing your sending sources is the most common DMARC implementation mistake — it blocks legitimate emails from transactional services that haven't been set up with DKIM yet. Gmail and Yahoo now require DMARC p=none or higher for all bulk senders (5,000+ emails/day). This is a minimum bar — p=none with consistent SPF and DKIM pass rates is sufficient for compliance, but p=quarantine or p=reject provides meaningfully stronger protection for your domain's reputation. For parsing DMARC aggregate reports without reading raw XML, use a free DMARC report analyzer (dmarcian, MXToolbox, or Postmark's DMARC analyzer) to visualize which IPs are sending on your behalf and their authentication pass rates. The most actionable thing to look for in your first report: any sending source you didn't configure. An unfamiliar IP passing DMARC on your domain means a service you use (a CRM, a calendar tool, a team inbox) is sending email from your domain without being properly declared in your SPF record. Add it to SPF and DKIM before tightening enforcement.