DMARC
DMARC publishes the domain policy for SPF and DKIM failures: monitor, quarantine, or reject. It requires alignment between the visible domain and the authenticated domain, and delivers aggregate reports.
In practice
Deployment proceeds in stages: monitor first, quarantine next, reject last — aggregate reports reveal overlooked legitimate sending streams in between. Since 2024, major providers require it of bulk senders. Domains that never send mail deserve a reject policy: spoofing loves silent domains.