A record lives at _dmarc.example.com, for example v=DMARC1; p=reject; rua=mailto:dmarc@example.com; adkim=s. A message passes when SPF passes for an envelope domain aligned with the From domain, or a DKIM signature verifies for an aligned d= domain. Policies p (the domain), sp (subdomains) and np (non-existent subdomains) take none, quarantine or reject; rua and ruf request aggregate and failure reports, now specified in RFC 9990 and RFC 9991.
RFC 9989 replaced the informational RFC 7489 (2015) and the PSD extension RFC 9091 and put DMARC on the standards track. It removed the pct, rf and ri tags, added np, psd and t (test mode, which asks receivers to apply one level less than the stated policy), and replaced the Public Suffix List with a DNS tree walk of at most eight queries to find the organizational domain. Existing v=DMARC1 records keep working.
Gmail, Yahoo and Microsoft require at least p=none from bulk senders, and BIMI requires quarantine or reject. The usual rollout is p=none with reports, fixing every legitimate stream, then enforcement.