DMARC (Domain-based Message Authentication, Reporting, and Conformance) is a TXT record at _dmarc.<domain> that tells receivers what to do when SPF or DKIM checks fail and where to send aggregate reports.

DMARC Policy Check for apple.com

DMARC record looks good

Raw record

v=DMARC1; p=quarantine; sp=reject; rua=mailto:d@rua.agari.com; ruf=mailto:d@ruf.agari.com;

Policy p=quarantine — failing mail is routed to the spam folder.

v	DMARC1	provided
p	quarantine	provided
sp	reject	provided
pct	100	default
adkim	r	default
aspf	r	default
fo	0	default
rua	mailto:d@rua.agari.com

The policy values p=none / p=quarantine / p=reject move from observation to enforcement. p=none reports issues without acting; p=quarantine routes failing mail to spam; p=reject blocks it outright. The pct= modifier scales enforcement (start at low pct=, ramp up).

Start with p=none + a working rua= reporting address to gather data without disrupting mail flow. Once reports show clean SPF + DKIM alignment for legitimate senders, ramp pct from 25 to 100 under p=quarantine, then promote to p=reject. Without a reporting address, DMARC enforcement is blind.