DMARC
A policy record that tells receivers what to do when SPF or DKIM fails — and reports back what happened.
DMARC sits on top of SPF and DKIM. It says: "if a message claiming to be from this domain fails SPF and DKIM, do X." X is one of `none` (just monitor and report), `quarantine` (drop in spam folder), or `reject` (bounce outright).
Equally important: DMARC requests aggregate reports (rua=) telling you what messages are being rejected and where they came from. This is the only feedback loop you have on how the rest of the email ecosystem perceives your domain.
BoomSauce defaults new domains to `p=none; rua=mailto:dmarc-reports@<your-domain>` for the first 30 days — observe-only mode. Once the report data confirms only legitimate sources are signing, tighten to `p=quarantine` then `p=reject`.