The rule that tells inboxes to block fake mail claiming to be from your business — your strongest protection.
DMARC (Domain-based Message Authentication, Reporting & Conformance) publishes your policy at _dmarc.yourdomain.com. It says: if SPF or DKIM fail, should receivers reject the message, send it to spam, or just monitor?
none — watch only; fakes may still arrive.
quarantine — suspicious mail goes to spam folders.
reject — strongest; failing mail should not be delivered.
Without DMARC, other records give senders information but not enforcement. A reject or quarantine policy is the clearest signal to stop impersonation.
You can start in watch-only mode, but fake invoices may still reach your customers until you move to quarantine or reject — many owners upgrade once they confirm real mail still delivers.
