Adding a domain returns three records. Only the first is required, and the reason the other two are worded carefully is that a naive version of them can break mail you already send.
A TXT record carrying a public key generated for your domain alone. This is what actually authenticates your mail: our envelope sender is always our own bounce domain, so DMARC aligns through DKIM, not SPF. Publish this one and you are done.
If you already publish SPF — and if you use Google Workspace or Microsoft 365, you do — then adding a second v=spf1 record at your apex breaks your existing mail. So we do not hand you a record to paste. We hand you a merge instruction and a merge_token, showing the single include to add to the SPF record you already have.
We suggest a DMARC policy and we point rua at your address, not ours. A vendor that hands you p=none; rua=mailto:vendor.com has quietly downgraded your policy and taken your reports. If you already publish DMARC, leave it exactly as it is.
Add your domainThe rule behind all three: a record we ask you to publish must never be able to damage mail that has nothing to do with us.
