What DMARC does
DMARC tells receiving mail servers what to do with messages that claim to come from your domain but pass neither SPF nor DKIM in a way that lines up with the From address. It is a TXT record at _dmarc.yourdomain that starts with v=DMARC1 and carries a policy: p=none, p=quarantine or p=reject.
It also gives you visibility. With a rua address in the record, receivers send you daily aggregate reports that list who is sending mail in your name.
Reading the policy
p=none only collects reports and protects nothing. It is the right first step, because the reports show which legitimate services still need SPF or DKIM set up. p=quarantine sends failing mail to spam, and p=reject refuses it.
A common mistake is to stay on p=none for years. The check flags that, along with a missing record, more than one record, and a record without a valid p tag.
Rolling it out safely
Publish p=none with a reporting address, read the reports for a few weeks, fix every legitimate sender, then move to quarantine and finally to reject. The pct tag lets you apply the stricter policy to a share of your mail first. Subdomains follow the policy of the organisational domain unless the sp tag says otherwise.