SPF lists who may send for your domain; DKIM signs messages; DMARC ties them together and tells receivers what to do on failure — while sending aggregate reports (RUA) and optionally forensic samples (RUF, often limited).
Jumping straight to reject without monitoring can block legitimate mail (newsletters, billing apps, old scripts). Typical path: p=none (monitor only) → read reports → move to quarantine / reject. Under none, receivers still deliver mail, but you learn who sends as your domain.
Alignment and practical DNS
DMARC checks whether the From domain aligns with SPF and/or DKIM results (aspf / adkim strict vs relaxed). Third-party newsletters often send from their infrastructure — you need proper DKIM for your domain at the vendor or a sending setup that still passes alignment.
rua=mailto:... works for tiny volumes; most organisations route RUA to a collector service that parses XML into dashboards.
Someone must read the reports
XML blobs from Google, Microsoft, and others need tooling (DMARC SaaS, in-house parser). Build a habit: weekly or monthly review of new sources, legitimate failures, and suspected abuse from foreign IPs.
For your domain, DMARC is a low-cost layer against look-alike senders. It complements user training; it does not replace it.