DMARC (Domain-based Message Authentication, Reporting & Conformance) publishes a DNS policy specifying what receiving servers should do with emails failing SPF/DKIM: none (monitor), quarantine (send to spam), or reject (block). Start with p=none to monitor, then move to p=quarantine once SPF and DKIM pass consistently. DMARC protects your domain from spoofing and is increasingly required by Gmail and Yahoo for bulk senders (5,000+ emails/day).