DMARC builds on SPF and DKIM by adding a published policy (none, quarantine, or reject) and a reporting address. It only evaluates alignment against the visible From domain, so a message can pass SPF and DKIM individually and still fail DMARC if neither is aligned to that domain.
Start new domains at p=none to collect aggregate reports without affecting delivery, then move to quarantine and eventually reject once every legitimate sending source is confirmed authenticated. Jumping straight to reject on an unaudited domain risks silently dropping real mail.
Aggregate reports (rua) arrive daily as XML from participating receivers and are the primary way to discover unauthorized or misconfigured senders using a domain.