What is DMARC?
DMARC is a DNS TXT record at _dmarc.yourdomain that tells receivers what to do with mail that claims your domain and fails authentication. A message passes when SPF or DKIM passes for a domain that aligns with the visible From address. The policy is none, quarantine or reject, and RFC 7489 defines it.
Reading the result
You get the published record, the policy (p=), any separate policy for subdomains (sp=), the share of mail it covers (pct=) and where reports go: rua= for aggregate reports, ruf= for failure reports. The tool gives no advice on moving to enforcement. That decision needs report data showing your real senders pass, and an anonymous lookup has none.
Beat runs on the same engine, on a schedule, across all 41 checks and 25 blacklists. What it adds is asking again, noticing when an answer changes and telling you what to do about it.
Common DMARC record problems
A policy of p=none
Reports only. Mail that fails DMARC is delivered as normal, so spoofing your domain still works. It is the right first step while you read reports, and the wrong place to stay.
No rua= address
Without aggregate reports you cannot see who sends as your domain, which also means you cannot move to quarantine or reject safely.
pct below 100
The policy applies only to that share of failing mail. RFC 7489 gives the rest the next policy down, so pct=50 on reject quarantines the other half.
Two DMARC records
If _dmarc returns more than one record, receivers apply no DMARC policy at all. Edit the existing record instead of adding another.