Read a DMARC record, and understand alignment, which is what most authentication problems actually turn out to be.
SPF and DKIM each prove something narrow. DMARC ties them to the address a person actually sees. It tells receivers what to do when a message claiming to be from your domain fails those checks, and it asks them to send you reports about who is sending as you.
Alignment is the part almost nobody explains, and it is behind most of the confused tickets. DMARC does not ask whether SPF passed. It asks whether SPF passed for a domain that matches the one in the From header. Mail sent through a third party often passes SPF perfectly against that provider's own bounce domain, which the recipient never sees, and fails DMARC because that domain is not yours. Relaxed alignment, the default, accepts an organisational match so a subdomain counts. Strict requires the names to be identical, and people set it because it sounds safer and then lose mail from their own subdomains.
A policy of none is worth understanding clearly. It asks receivers to report and to change nothing, which means a domain on p=none is exactly as spoofable as one with no DMARC record at all. It is the right place to start, because the reports tell you what would break before you enforce. It is a bad place to stay, and a great many domains have been there for years without anyone realising the record is not protecting them.
Not at p=none, which changes no delivery behaviour and only starts the reports. The risk comes when you enforce before reading them, so read the reports first and confirm every legitimate sender aligns.
Yes, and increasingly you need it to deliver at all. SPF and DKIM authenticate technical identifiers a recipient never sees. DMARC is what connects them to the visible From address, and large receivers now expect it from anyone sending volume.