Attackers are sending email that spoofs the company's exact domain to its customers. The company already publishes SPF and DKIM records, but receiving servers have no instruction on what to do when those checks fail, and the company receives no reports about such mail. Which step best addresses this?

Domain-based Message Authentication, Reporting and Conformance builds on SPF and DKIM. A DMARC record tells receiving servers to check that a message passes SPF or DKIM with an identifier aligned to the visible From domain, states a policy for messages that fail, either none, quarantine or reject, and requests aggregate and optionally forensic reports. Publishing an enforcing policy with reporting directly fixes both gaps described: receivers gain instructions to quarantine or reject spoofed mail, and the company starts receiving reports showing who is sending as its domain. A Brand Indicators for Message Identification record displays a verified logo next to authenticated mail in supporting clients, but it relies on DMARC being enforced and gives receivers no failure policy of its own. Adding third-party sending services to the SPF record helps legitimate mail pass, which matters before enforcing, but it does not tell receivers to act on failures or produce reports. Rotating the DKIM key and lengthening it improves key hygiene, yet spoofed mail fails DKIM either way, and the missing piece is still a policy and reporting. Exam caveat: organizations typically start at a policy of none to collect reports, fix legitimate senders, and then move to quarantine and reject. Operational check: query the domain's DMARC record to confirm the policy and reporting address, then confirm aggregate reports begin arriving.