DMARC is a TXT record published at _dmarc followed by the domain name. A message passes if SPF or DKIM passes and the domain it used matches the From address people see, which is called alignment. The policy tag sets the action for failures: none only monitors, quarantine sends failures to spam, and reject refuses them. Receivers send back aggregate reports listing who is sending as the domain.
SPF and DKIM alone do not stop someone putting your domain in the From line. DMARC closes that gap, which protects customers and suppliers from fake invoices sent in your name. Large mailbox providers, including Google and Yahoo, require bulk senders to publish a DMARC record, so it now affects whether legitimate marketing and transactional email is accepted.
Jumping straight to reject can block real mail from tools nobody remembered, such as a booking system or scanner. Start at none, read the reports, fix each legitimate sender, then tighten to quarantine and reject. A policy left at none forever gives visibility but no protection. Subdomains and domains that send no mail need attention too. We move client domains to enforcement in stages, checking reports along the way.