DMARC stands for Domain-based Message Authentication, Reporting and Conformance. SPF and DKIM each verify something about a message, but neither checks the From address a person actually sees, and neither says what should happen on failure. DMARC closes both gaps. A message passes only if SPF or DKIM passes and the domain it verified lines up with the visible From domain, which is called alignment.
The record lives at _dmarc.your-domain.com and sets a policy: none means only monitor, quarantine means treat failing mail as suspicious, and reject means refuse it. The rua tag names an address that receives aggregate reports showing who is sending mail under your domain, including services you forgot about and anyone impersonating you.
Begin with p=none and read the reports until every legitimate sender passes, then move to quarantine and finally reject. Staying on none forever gives visibility but no protection, since forged mail is still delivered.
_dmarc.your-domain.com. TXT "v=DMARC1; p=none; rua=mailto:dmarc-reports@your-domain.com"