A financial services company keeps receiving emails that appear to come from its own domain, tricking employees into wire transfers. The security team has already implemented SPF but attackers are still successfully spoofing the exact 'From' header address. Which control should be added to reject messages that fail domain alignment and provide the organization with visibility reporting on spoofing attempts?