How DMARC decides pass or fail
A receiver evaluates SPF and DKIM for a message, then asks whether either result is aligned with the domain in the From header. Aligned means the SPF envelope domain or the DKIM d= domain matches the From domain exactly (strict) or shares its organizational domain (relaxed, the default). If at least one aligned check passes, DMARC passes. Otherwise the receiver applies the policy in p.
The record is a TXT at _dmarc.yourdomain, for example v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com; adkim=r; aspf=r. Tags are separated by semicolons and v=DMARC1 must come first. Everything after p is optional and has a default: pct 100, sp the same as p, adkim and aspf relaxed, ri 86400 seconds between aggregate reports.
What each tile and finding means
The Policy tile shows p as published; the Subdomains tile shows sp, or p with (inherited) when sp is not set; Applied to shows pct and turns amber below 100. The record card names the exact host the record was found at, which is the organizational domain when the lookup fell back to it.
Failures are things that make receivers ignore the record: no record, two records at the same name, a tag without an equals sign, v not exactly DMARC1 or not first, a missing or invalid p, an sp, pct, adkim or aspf value outside its allowed set, or a rua or ruf entry that is not a mailto: address. Warnings cover a duplicate or unknown tag, invalid fo values, a non-numeric ri, a missing rua, an unauthorized external destination, p=none, pct under 100, and sp=none on an otherwise enforced domain.
Informational notes tell you when the record was inherited from the organizational domain and point out that ruf is set, since the large mailbox providers do not send forensic reports.
Getting from none to reject
p=none changes nothing about delivery. It exists so you can collect aggregate reports and find every service that sends as the domain. Publish it with a rua address, wait for a few weeks of reports, and read them in the DMARC Report Analyzer. Any legitimate source that fails needs SPF or DKIM fixed before you tighten the policy.
Then move to p=quarantine, optionally with a pct below 100 to limit the damage from a missed sender, and finally to p=reject at pct=100. Build each version with the DMARC Generator and re-run this checker after every change. Do not leave sp=none behind once the main domain is enforced. An unused subdomain is exactly what a forger picks because nobody watches it.
Report destinations and why some stay empty
rua names where daily aggregate XML reports go. ruf names where per-message failure reports would go. Several addresses are allowed, comma separated, each as a mailto: URI. If an address is on a different domain, that domain has to opt in with the _report._dmarc record described above, which hosted DMARC services publish for their customers.
If the lookup for that authorization record fails outright, the checker says it could not verify the destination instead of guessing. A missing rua is flagged as a warning because enforcing a policy without reports means guessing which mail you are about to block.
Limits of a record check
The checker reads the published policy. It does not see what receivers do with your mail. A domain can have a perfect record and still fail DMARC on every message because DKIM signing is misconfigured. Pair this check with the DKIM Checker and the SPF Checker for the two underlying mechanisms.
The organizational domain is approximated from a list of common two-label public suffixes rather than the full Public Suffix List, so an unusual registry suffix may be treated as a subdomain. Lookups use public resolvers with a short timeout, results are cached for about a minute, and nothing you enter is stored.