What DMARC adds on top of SPF and DKIM

SPF and DKIM each authenticate something narrower than what a recipient actually sees: SPF checks the invisible envelope sender, DKIM checks that a message wasn't tampered with in transit and was signed by a specific domain — but neither one requires that the domain they authenticate matches the visible "From:" header a person actually reads. DMARC closes that gap by requiring alignment: at least one of SPF or DKIM has to pass **and** correspond to the same domain shown in the visible From header, not just any domain. That alignment check is what actually prevents visible-sender spoofing, and it's the specific protection SPF and DKIM alone don't provide on their own — DMARC is the mechanism that ties them together into something that protects what a recipient actually sees.

Why p=none is a legitimate, common starting state

A DMARC policy of `p=none` doesn't enforce anything — mail that fails alignment is delivered normally either way — but it does turn on aggregate reporting, which sends the domain owner a steady stream of data about who's actually sending mail claiming to be from their domain and whether it passes SPF/DKIM alignment. That visibility is exactly why `p=none` is the standard, recommended first step of a DMARC rollout: it lets a domain owner discover every legitimate sending source (marketing platforms, CRM tools, internal systems) before committing to `quarantine` or `reject`, which would otherwise risk silently breaking legitimate mail that hadn't been accounted for.

Why pct= exists and what it actually controls

The `pct=` tag lets a domain apply its DMARC policy to only a percentage of mail that fails alignment, selected pseudo-randomly by receivers — a gradual dial rather than an all-or-nothing switch from monitoring to full enforcement. This is specifically useful for de-risking the move from `p=none` to `p=reject`: starting at `pct=10` and increasing over weeks lets a domain owner watch for unexpected legitimate mail getting rejected at a limited blast radius, rather than discovering an overlooked sending source only after cutting over to 100% enforcement all at once.