Very complete guide. Worth adding one limit for readers: DMARC protects your exact domain, but attackers often register lookalikes instead (an extra letter, a different TLD), and DMARC can't stop those. Monitoring for lookalike and newly registered domains is the other half. Phishing domain feeds cover that side (whoisfreaks.com/products/threat-intelligence-feed).