DMARC
Domain-based authentication policy that tells receivers what to do with unauthenticated mail and reports results.
DMARC (Domain-based Message Authentication, Reporting, and Conformance) is a published policy that sits on top of SPF and DKIM. It tells receivers (a) what to do with email that fails authentication for your domain and (b) where to send reports about authentication outcomes.
DMARC policies are published as DNS TXT records. The policy can be set to "none" (just monitor, take no action), "quarantine" (send failing mail to spam), or "reject" (block failing mail outright). Most senders start at "none" to collect data, then graduate to "quarantine" and "reject" as they tune their authentication setup.
DMARC also requires alignment: the domain that passes SPF or DKIM must match the domain in the visible From: header. This is the protection against spoofing — an attacker can't send mail "from" your domain even if they pass SPF or DKIM for a different domain.
Since 2024, Gmail and Yahoo require DMARC for bulk senders. A DMARC policy of "p=none" with proper SPF and DKIM is the minimum compliance threshold.