DMARC (Domain-based Message Authentication, Reporting and Conformance)

DMARC is a TXT record at '_dmarc.yourdomain.com'. It does three things. It says that a message must pass SPF or DKIM, and that the passing domain must match the From domain. It sets a policy for failures: 'none' (only report), 'quarantine' (treat as suspicious) or 'reject' (refuse). And it gives an address for reports ('rua') so you can see who sends mail in your name.

A safe way to start is 'p=none' with a report address. Read the reports for a few weeks, fix any real sender that fails, and then move to 'quarantine' and later 'reject'. Moving too fast can block your own mail.

For cold email, DMARC is no longer optional. Gmail and Yahoo ask bulk senders to publish at least a 'p=none' policy. Many cold senders skip it on secondary domains and then wonder why mail lands in spam. Publish a record on every sending domain, and check that your mail provider signs in a way that matches your From domain.