What spoofed email is
The sender address on an email can be written however you like. Nothing in the base protocol stops someone from putting your domain in the from field. Attackers use this for phishing and invoice fraud, where the recipient trusts the name and therefore opens, clicks or pays.
DMARC is what lets you tell receiving servers that mail in your name should be provably genuine. Without it, the recipient has nothing to go on.
How SPF, DKIM and DMARC fit together
SPF lists which servers are allowed to send mail for your domain. DKIM signs every message with a key so the content and sending domain can be verified. DMARC ties the two together and tells the recipient what to do when a message passes neither SPF nor DKIM.
DMARC also requires the visible sender domain to match the one SPF or DKIM approves. That is why all three are needed for the protection to hold.
From p=none to p=reject without losing mail
Always start at p=none. Nothing changes for recipients, but you receive reports on which services send in your name. Add a rua address so the reports land somewhere you actually read them.
When the reports show that all your legitimate senders, newsletters, booking systems and the like, pass SPF or DKIM, raise the policy to p=quarantine. Spoofed mail then lands in the junk folder. If there are still no problems, take the final step to p=reject, which rejects spoofed mail outright.
Move one step at a time and wait a few weeks between steps. That is the difference between protection that holds and one that silences your own mail.
Common mistakes
Jumping straight to p=reject before all senders are mapped is the most common error and causes real mail to disappear. Just as common is forgetting an external service, such as a CRM or an invoicing system, that sends in your name.
Two SPF records on the same domain is invalid and makes SPF stop working. Always keep exactly one. Also confirm that you actually read the DMARC reports, otherwise you miss the signals.
A quick check in KOLLEN shows where you stand today. If you want ongoing oversight of your Microsoft 365 environment, PIANOLA is the next step.