What DMARC Does

At its core, DMARC builds on SPF and DKIM to give domain owners (like you) a say in how emails from your domain should be handled. With DMARC, you publish a policy in DNS that says, ‘If an email fails SPF/DKIM checks, do X.’ X can be
1 – Do nothing and just report it (p=none) – essentially watching and collecting data (useful as a first step).
2 – Quarantine it (p=quarantine) – typically means send it to spam/junk.
3 – Reject it outright (p=reject) – tell the receiving server to chuck that email in the bin before it ever reaches a user.

By aligning the domain in the emails’ ‘From’ header with the authenticated domain (SPF/DKIM), DMARC closes loopholes. If spoofers try to fake the ‘From’ address DMARC will catch it and apply your chosen policy. DMARC says ‘Only trust emails from my domain if SPF and DKIM say it’s really me; if not, here’s what to do.’