Build an SPF record
List the senders that may use the domain, then choose what happens to everyone else. ip4 and ip6 entries take a single address or a CIDR range and cost no DNS lookups, so listing your own mail servers by address is the cheapest way to authorize them. include, a, and mx each cost one, and an include also spends whatever the provider’s record spends.
Ten lookups is the ceiling. Trimming a and mx when neither host actually sends mail is usually the quickest way back under it.
The ending matters most
The final mechanism decides what happens to every sender you did not list. -all is a fail, ~all is a softfail that receivers usually accept and mark, ?all is neutral and no better than publishing nothing.
Start with ~all while reading DMARC aggregate reports, then move to -all once the reports show no legitimate sender failing.
DMARC rollout order
Publish p=none with a rua address first and read the reports for a few weeks. They arrive as daily XML summaries listing every source that sent as your domain, whether SPF and DKIM passed, and whether they aligned.
Move to p=quarantine once every legitimate source aligns, then p=reject. Skipping to reject before the reports are clean is what causes invoices and password resets to disappear.
Subdomains
sp sets the policy for subdomains. Leave it inherited and subdomains follow p. Set it explicitly when a subdomain is used by a platform you do not control yet and you need the parent domain locked down first.
A subdomain that sends no mail at all is best covered by a strict parent policy rather than left unset.
Before you publish
Send from every path you own, not only the main one: transactional mail, marketing platforms, help desk, invoicing, calendar invitations. Each one that sends as your domain needs its ranges or its include in the record, or it fails SPF the moment the policy tightens.
The DNS entry panel gives the three fields a DNS panel asks for: the name, the type, and the value. SPF goes on the domain itself, so the name is @ or blank; DMARC goes on _dmarc. Every record built here is parsed as it is composed, and the SPF and DMARC record checker reads the published version once the change has propagated.