Choose a policy and where reports go. Get the DMARC record, the host to publish it at, and what each tag will do.
DMARC (RFC 7489) tells receiving mail servers what to do with a message that
claims to come from your domain and fails both SPF and DKIM for that domain,
and it asks them to send you reports about what they saw. It is a TXT record
published at _dmarc under your domain.
The policy tag carries the decision. p=none only asks for reports.
p=quarantine asks for failing mail to go to spam.
p=reject asks for it to be refused. Until a domain reaches
quarantine or reject, anyone can still send mail that shows it in the From
line.
Publish p=none with a report address first. Within a few days the
aggregate reports show every server sending as your domain, including the ones
nobody remembered. Fix each real sender so that it passes SPF or signs with
DKIM using your domain. Then move to quarantine, and then to reject. The
percentage tag lets a stricter policy apply to part of the failing mail while
you watch for mistakes.
Aggregate reports are XML files sent once a day by each receiver. Send them to a mailbox made for the purpose, or to a reporting service, and not to a person's inbox.
Subdomain policy (sp) sets a different policy for
subdomains. Leave it out and they inherit the main one.
Alignment (adkim, aspf) is relaxed
by default, which accepts a subdomain of your domain. Strict demands an exact
match and breaks senders that use a subdomain, so choose it only when you know
why.
Reports to another domain. If the report address is at a different domain, that domain must publish a small record saying it agrees to receive them. When that applies, the result gives the exact record to pass on.
Once the record is live, confirm it with the DMARC checker, and build the matching sender list with the SPF record generator. Gmail and Yahoo both ask bulk senders to publish a DMARC record, so this is no longer optional for a domain that sends newsletters or notifications.
As a TXT record at _dmarc under your domain, for example _dmarc.example.com. In most DNS panels you type _dmarc as the host and paste the record as the value.
Start with p=none and an address for aggregate reports. It changes nothing about delivery and shows you who sends as your domain. Move to quarantine and then reject once the reports show your real mail passing.
rua is where aggregate reports go: a daily summary from each receiver of how much mail passed and failed, by sending address. ruf asks for a report about individual failures. Few receivers send those, for privacy reasons.
You need at least one of them passing with your own domain for a message to pass DMARC. Set up both where you can. Forwarded mail usually fails SPF, and DKIM is what keeps it passing.
It stops mail that uses your exact domain in the From address at receivers that honor DMARC, which the large mailbox providers do. It does not stop lookalike domains or a display name that imitates you.