Set up DMARC

1. Start: add _dmarc TXT v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com. You'll get daily reports.
2. After 2–4 weeks with all legitimate mail passing, change to p=quarantine.
3. Then p=reject. Forged mail claiming to be you is now refused.

Make sure every service that sends as your domain (Google Workspace, CRM, Postwave) is authenticated before tightening.