In more detail
A message passes DMARC when SPF or DKIM succeeds and the authenticated domain matches the visible From domain. The policy p= is none, quarantine or reject, and rua= names the address for aggregate reports. Moving from none to reject in steps is the standard way to stop others spoofing your domain. The record is a DNS TXT entry at _dmarc.yourdomain. Alignment can be relaxed (adkim=r, aspf=r, the default), where mail.example.com aligns with example.com, or strict (s), where the domains must be identical.
Why it matters
SPF and DKIM on their own say nothing about the From address people actually see, so without DMARC anyone can send mail that appears to come from your domain. Large mailbox providers now expect bulk senders to publish at least a p=none DMARC record, and the aggregate reports reveal every service sending as you, including forgotten ones and Phishing campaigns.
Example
_dmarc.example.com. TXT "v=DMARC1; p=quarantine; rua=mailto:[email protected]; adkim=r; aspf=r"
A message with From: [email protected], a valid DKIM signature with d=mail.example.com and an SPF pass for bounces.esp.example passes DMARC: SPF is not aligned, but DKIM is (relaxed). With adkim=s it would fail and be sent to spam. Build the record with the DMARC Record Generator.