DMARC
A policy telling receiving servers what to do when SPF and DKIM checks fail.
DMARC ties SPF and DKIM together. It is a DNS record that states what should happen to mail claiming to be from your domain that passes neither check: let it through, put it in spam, or reject it outright.
It also asks receiving servers to send you reports, which is how you find out that something is sending mail as your domain — a forgotten service, or somebody impersonating you.
The usual path is to publish a monitoring-only policy first, read the reports until you recognise every legitimate sender, and only then tighten it.