Outbound Glossary
DMARC
The layer that checks the From address a reader actually sees against the domain SPF or DKIM authenticated, and the only one of the three that reports back.
DMARC sits on top of SPF and DKIM and asks the question neither of them asks: does the From address the reader sees belong to the same domain that SPF or DKIM authenticated? That match is called alignment, and one of the two passing in alignment is enough. Which is why a message can pass SPF cleanly and still fail DMARC, because the domain SPF checked was not the domain in the From line. Where there is no aligned pass, DMARC states what the receiver should do and asks receivers to report back on what they saw. The policy runs from none, which only watches, through quarantine, to reject.
Most domains should start at none with reporting turned on, read a few weeks of reports, and only then tighten. Jumping straight to reject on a domain whose sending you have not mapped is how a company loses its invoices. For outbound specifically, DMARC also matters because mailbox providers increasingly treat a missing policy as a reason for suspicion.