Published as a DNS TXT record at `_dmarc.yourdomain`, DMARC sets a policy — `p=none`, `quarantine`, or `reject` — and additionally requires that a passing SPF or DKIM result *align* with the visible From domain. Receivers enforce the policy and send aggregate reports to the address in the `rua=` tag.
DMARC is the piece that actually stops From-header spoofing, which SPF and DKIM cannot do alone. The critical rollout discipline is to start at `p=none` (monitor only): use the aggregate reports to inventory every legitimate service sending as you and confirm each one aligns before tightening the policy. Jumping straight to `reject` can blackhole your own newsletters and transactional mail.
Practically: publish `p=none`, read the reports for a few weeks, fix each sender to align via SPF or DKIM, then ratchet to `quarantine` and finally `reject`. As of February 2024 Gmail and Yahoo require DMARC for bulk senders, so enforcement is no longer optional at scale.