Understand the authentication check
DMARC evaluates whether a message passes SPF or DKIM with a domain aligned to the visible From domain. Either aligned method can establish a pass, as explained in Google’s DMARC documentation.
This is different from checking whether SPF and DKIM simply agree with one another. Review actual message headers to see which method passed and which domain was authenticated.
Understand the policy
A domain publishes a DMARC record in DNS. Google describes monitoring, quarantine, and reject policies in its setup guidance.
A policy is an instruction for handling authentication failures, not a guarantee that a message will reach the inbox. Other filtering and delivery considerations still apply.
Use reports to identify senders
DMARC can request aggregate reports that help show how mail using the domain is authenticating, as described in Google’s reporting guidance.
Compare the observed sources with an inventory of approved systems. Investigate legitimate services that fail alignment before tightening policy.
Keep ownership clear
Name the person responsible for DNS changes and the person reviewing email delivery. Coordinate when a new sending tool is introduced or an old one is retired.
Keep the current configuration and change history available. Authentication work is easier to maintain when it is part of an operating process rather than an unexplained DNS record.