If you send bulk mail to Gmail, Yahoo or Microsoft users, yes: they require at least p=none, with enforcement active. Beyond that requirement, without DMARC you have no way to tell receivers what to do about forgeries and no visibility into who is sending as your domain.

Does p=none protect me?

No, p=none takes no action on failing mail; it only produces reports. It is the correct first stage because those reports tell you what is safe to enforce, but a record left at p=none indefinitely provides visibility and no protection. Protection begins at quarantine or reject.

Where does the DMARC record go?

In a TXT record at _dmarc followed by your domain, for example _dmarc.example.com. The leading underscore is required, and it does not go at the apex like SPF. Unlike SPF, one DMARC policy covers your subdomains by default.

ConceptDMARC

What is DMARC?

DMARC (Domain-based Message Authentication, Reporting and Conformance) is the record that ties SPF and DKIM to the From: address a person actually sees, and tells receivers what to do when a message fails. It is the only one of the three that protects the visible sender, and the only one that can instruct a receiver to quarantine or reject forged mail. Google, Yahoo and Microsoft now require it for bulk senders, so for many domains publishing DMARC is no longer optional.

See it on your own domainDMARC checker

Alignment: the idea that makes DMARC work

SPF and DKIM each authenticate a domain, but not necessarily the domain the recipient sees. DMARC adds alignment: it passes only when an authenticated identity (from SPF or DKIM) matches the domain in the visible From: address. That is what closes the spoofing gap SPF and DKIM leave open: a message can pass SPF for a domain the sender owns while displaying yours, and DMARC is what catches exactly that.

The three policies, and how to move through them

A DMARC record's p= tag sets the policy: none (monitor only, evaluate and report, take no action), quarantine (send failing mail to spam), or reject (refuse it outright). The safe path is to start at p=none with a reporting address, read the reports until you are confident every legitimate sender passes, then move to quarantine and finally reject, using the pct tag to enforce on a fraction of mail first. Enforcing before you have read the reports is how legitimate mail gets rejected.

Reporting is the point of p=none

At p=none, DMARC changes nothing about how mail is handled, but it makes receivers send you aggregate reports listing every source sending as your domain. Those reports are the only reliable way to discover the invoicing tool or forgotten server you did not know was sending, which is exactly the information you need before you can enforce safely. A DMARC record with no reporting address is a policy you cannot safely change.

Common questions

Do I need DMARC?: If you send bulk mail to Gmail, Yahoo or Microsoft users, yes: they require at least p=none, with enforcement active. Beyond that requirement, without DMARC you have no way to tell receivers what to do about forgeries and no visibility into who is sending as your domain.
Does p=none protect me?: No, p=none takes no action on failing mail; it only produces reports. It is the correct first stage because those reports tell you what is safe to enforce, but a record left at p=none indefinitely provides visibility and no protection. Protection begins at quarantine or reject.
Where does the DMARC record go?: In a TXT record at _dmarc followed by your domain, for example _dmarc.example.com. The leading underscore is required, and it does not go at the apex like SPF. Unlike SPF, one DMARC policy covers your subdomains by default.