DMARC
A DNS policy that tells receiving servers what to do with mail that fails SPF and DKIM for your domain, and where to send reports about it.
DMARC ties SPF and DKIM to the address people actually see, the From header. A message passes DMARC when SPF or DKIM passes *and* the domain that passed matches the From domain. That alignment is what stops someone sending mail that shows your address while passing SPF for their own domain.
The record lives at _dmarc.<domain>: v=DMARC1; p=reject; rua=mailto:reports@example.lu. The p= tag is the policy: none only reports, quarantine sends failures to spam, reject refuses them. rua= is where daily aggregate reports go; they tell you who is sending as your domain and whether it passes.
Start at p=none, read the reports for a few weeks, fix every legitimate sender that fails, then move to quarantine and finally reject. Large mailbox providers now require a DMARC record from anyone sending in volume, and BIMI requires enforcement.