DMARC blocks spam and phishing emails sent from spoofed domains, and it’s vastly underutilized, a new report says.