Read your DMARC policy + pct% and flag weak none vs strict reject.
Pull the DMARC record at _dmarc.yourdomain.com, parse the policy (none / quarantine / reject) and the percentage applied. DMARC tells receivers what to do with mail that fails SPF + DKIM alignment — without it, you cede that decision to whoever spoofs you.
This reads the record at _dmarc on your domain and reports the policy and percentage, which is where you sit on the none → quarantine → reject ramp.
p=none is a starting line, not a finish line: it collects reports and offers no protection at all. Anything still sitting there once your senders are authenticated is unfinished work.
Nothing to delivery — it's monitor-only. p=none lets you collect aggregate reports (via the rua tag) showing who sends as your domain, without any enforcement. It's the safe first step, but it offers no protection against spoofing until you ramp to quarantine or reject.
quarantine tells receivers to treat failing mail as suspicious (typically route to spam); reject tells them to refuse it outright at SMTP time. reject is the goal state — it's what stops spoofers from spoofing you at all.
pct controls what fraction of failing mail the policy applies to — pct=25 means only a quarter of failing messages get quarantined or rejected, the rest fall back to the next-weaker action. It's a rollout safety valve; you lower the risk while ramping, then remove it (defaulting to 100%) once you're confident.
DMARC requires alignment, not just a pass. SPF authenticates the envelope-from domain, which often differs from your visible From: domain when an ESP sends on your behalf — so SPF passes but doesn't align. DKIM alignment usually solves this; check that your ESP signs with your domain, not theirs.
For bulk senders, yes — both now require at least a published DMARC record (p=none is the minimum) along with SPF and DKIM. Many security-conscious receivers go further and downrank domains still sitting at none.
Stay at p=none with reporting until your aggregate reports show every legitimate source authenticated and aligned. Then step to quarantine (optionally with a low pct), watch the reports, raise pct to 100%, and finally move to reject. The DMARC generator scaffolds each stage.
SieveGuard's Domain Health add-on monitors your DMARC policy on every domain you onboard, flags any drift back toward p=none, and shows enforcement status next to SPF and DKIM so you always know where you sit on the road to reject.