DMARC

The policy that says what to do when SPF and DKIM fail.

DMARC is the domain owner's instruction for email that fails verification: do nothing, quarantine it, or reject it. It also reports who is sending in your name. You need to watch in report mode for a while before tightening the policy — otherwise your own invoices or newsletter can be rejected too.