DMARC
The policy you publish telling receiving servers what to do with mail that fails SPF and DKIM
DMARC, Domain-based Message Authentication, Reporting and Conformance, ties SPF and DKIM to the From address a human actually sees, and publishes your instruction for what should happen when both fail.
A record looks like this:
v=DMARC1; p=reject; rua=mailto:dmarc@yourcompany.comp= is the policy: none (do nothing, just report), quarantine (treat as suspicious,
usually the spam folder), or reject (refuse outright). rua= is where aggregate
reports are sent, and those reports are how you find out which of your systems is sending
mail you had forgotten about.
Alignment is the part that surprises people
DMARC passes when SPF or DKIM passes and the domain that passed matches the domain in the From header. That second condition is called alignment, and it is why mail can pass SPF, pass DKIM, and still fail DMARC: the passing signal belonged to a different domain.
How to roll it out
Start at p=none and read the reports for a few weeks. Move to p=quarantine, then to
p=reject, and only once the reports show nothing legitimate failing. Publishing
p=reject on day one is how an organisation discovers that its invoicing system was
sending mail nobody remembered.
In Sendly
The record to publish is shown alongside your SPF and DKIM values, and guided DNS setup can publish it. Sendly does not choose your policy for you: the escalation above is a decision about your own mail flow, including systems Sendly cannot see.