Read the DMARC policy and reporting tags.
DMARC combines SPF and DKIM to decide what to do with unauthenticated mail. The record lives at _dmarc.yourdomain.com.
none only collects reports. quarantine sends suspicious mail to spam. reject discards it. RUA receives aggregate XML reports.
Without DMARC, your brand is easy to impersonate. A common path is none + rua, then a move toward reject.
pct= applies the policy to a percentage of mail; 100 is full enforcement. adkim and aspf set r (relaxed) or s (strict). sp= is the subdomain policy.
No. SPF can fail alignment when envelope-from differs. DMARC requires alignment.
A mailto: address that receives XML reports of who tried to send as you.
Watch reports, put sources on SPF/DKIM, then quarantine, then reject. Jumping to reject can drop real mail.
Forensic failure reports. Many receivers no longer send ruf; rua is enough.
Without sp=, p= applies to subdomains too. Use sp= or a separate _dmarc for a different policy.
Yes. BIMI usually wants enforce (quarantine/reject) DMARC.