DMARC (Domain-based Message Authentication, Reporting and Conformance) is a TXT record at _dmarc.yourdomain.com. It tells receiving servers what to do with email that claims to be from your domain but fails authentication, and asks them to send you reports.
The three policies
p=none: deliver as normal and just report. The place to start.p=quarantine: send failing email to spam.p=reject: refuse failing email.
Alignment
DMARC passes when SPF or DKIM passes for the same domain as the From address. That link between the two is called alignment, and it is what stops someone using your name with their own server.
Why it matters for cold email
Since 2024, Gmail and Yahoo require a DMARC record from bulk senders. A p=none record meets the rule and starts the reports, which show every server sending email as your domain.
What the record looks like
A starting record is v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com. p is the policy, and rua is where receivers send their aggregate reports, usually once a day, as files listing which servers sent email as your domain and whether it passed.
Moving to a stronger policy
Start at none and read the reports until every service that sends as you passes. Then move to quarantine, and to reject once nothing real is failing. Jumping straight to reject can block your own email.
How to check yours
Write a record with the DMARC generator, and check SPF, DKIM and DMARC together with the domain health checker.