What is a DMARC record?
A DMARC record is one line of text published as a DNS TXT record at _dmarc.yourdomain. It starts with v=DMARC1, sets a policy with p= (none, quarantine or reject) and usually names a mailbox for reports with rua=. Receivers read it to decide what happens to mail that fails SPF and DKIM alignment for your domain.
Reading the result
The output is the exact value to publish, with its host and record type. Warnings sit under it when a choice is risky: no rua= address, reject without reports, strict alignment. pct= is left out at 100 because that is the default, and relaxed alignment is left out for the same reason, which keeps the record short.
Mistakes it warns about
Starting at reject
A forgotten sender, such as an invoicing system or a helpdesk, has its mail rejected the day the record goes live. Start at p=none, read the reports, then tighten.
Strict alignment by accident
adkim=s and aspf=s demand an exact domain match. Services that send from a subdomain such as mail.yourdomain then fail, where relaxed alignment would have passed them.
A report address on another domain
If rua= points at a different domain, that domain has to publish an authorisation record (yourdomain._report._dmarc.theirdomain) or receivers will not send it your reports. Most report services set this up for you.
Adding a second record
Publish the result by replacing any existing DMARC record. Two records at _dmarc mean receivers apply no policy at all.