First deploy SPF and DKIM correctly (Google Workspace requires both for DMARC to pass alignment). Then add this TXT record at _dmarc.yourdomain.com: v=DMARC1; p=none; rua=mailto:[email protected]. Start at p=none (monitor mode) — DMARC won’t reject anything, but you’ll get daily aggregate reports showing who’s sending mail as your domain. Wait 4-8 weeks reviewing reports, add missing legitimate senders to your SPF/DKIM setup, then step up to p=quarantine and eventually p=reject. Never jump straight to p=reject without a monitoring period. Use the DMARC lookup tool to verify the record.
All questions
How do I set up DMARC for Google Workspace?
Read the full guide
What Is DMARC?
DMARC is the enforcement layer of email authentication. SPF and DKIM do the checking — DMARC tells receiving servers what to do when they fail, and reports back to you who's sending email using your domain.