What happens without DMARC
An attacker can put your domain in the From address and send mail. This is how invoice fraud starts: a supplier believes the message and pays the wrong account. SPF stops part of it, but DMARC is what decides the outcome when SPF fails.
The three policy levels
p=none only monitors and still delivers. p=quarantine sends suspicious mail to spam, and p=reject refuses it outright. Starting at none and reading the reports for a few days before moving to quarantine is the safe path — a great many domains have simply been left at none for years.
How to set it up
Add one TXT record named _dmarc, for example: v=DMARC1; p=quarantine; rua=mailto:[email protected]. Daily reports arrive at the rua address, and reading a few of them shows exactly who is sending mail as your domain.