DMARC

DMARC tells receiving servers what to do when a message claiming to be from your domain fails SPF and DKIM alignment, and where to send reports. Gmail and Yahoo require it from anyone sending in volume, and it protects your domain from spoofing.

SpacePost returns a recommended starter record with every domain:

Type	Name	Value
TXT	`_dmarc`	`v=DMARC1; p=none;`

It is not required for verification, but add it.

How alignment works with SpacePost

DKIM: messages are signed with d=acme.com via your three Easy DKIM CNAMEs. This aligns with From: hello@acme.com.
SPF: the envelope sender (return path) is send.acme.com, a subdomain of your From domain, so SPF aligns in relaxed mode. This is why the send MX and TXT records matter.

Either one aligning is enough for DMARC to pass; having both is the most robust.

Policies

Policy	Effect	When
`p=none`	Monitor only. Nothing is blocked.	Start here.
`p=quarantine`	Failing mail goes to spam.	After reports are clean for a few weeks.
`p=reject`	Failing mail is rejected.	Full protection.

A typical progression with reporting:

v=DMARC1; p=none; rua=mailto:dmarc@acme.com; fo=1;
v=DMARC1; p=quarantine; pct=25; rua=mailto:dmarc@acme.com;
v=DMARC1; p=reject; rua=mailto:dmarc@acme.com;

rua is where aggregate XML reports go. Use a DMARC reporting service to read them.

Subdomains

A _dmarc record on acme.com also covers subdomains unless you add sp=. If you send from mail.acme.com, you can publish a separate _dmarc.mail record.