Finding the route…
Finding the route…
Early mistakes land in reports or spam; only the last step refuses. Each stamp is the real check, as if the steps above were published.
Read live from its published records. No DMARC policy applies.
DMARC needs SPF or DKIM to pass. Without SPF, enforced mail relies on DKIM alone.
This domain has no mail servers. If it never sends mail, this record locks it down. If it does send, put an include: for each sending service before -all.
p=none refuses nothing. It gets you reports on who sends as you, which makes the next steps safe.
Set up the rua= mailbox first, or use a report service. Expect machine-written files.
A mistake here is recoverable: forgotten mail lands in spam, not nowhere.
Read your DMARC reports for two to four weeks, to catch monthly senders. Fix anything of yours that fails.
Forged mail is refused, for your address and made-up subdomains.
Run quarantine until reports and spam stay quiet. Refused mail cannot be rescued.
With the last step published, forged mail in spf-report.com’s name is refused.
Each reading is the real check on these records plus the steps before it. Nothing is published. A policy is a request receivers apply as they choose. No record stops an approved service sending as you, or a lookalike domain.