A security engineer notices that attackers are sending emails that appear to originate from the company's own domain to trick employees into wiring funds. Legitimate outbound mail already passes SPF and DKIM checks. Which additional email security mechanism should the engineer configure to instruct receiving servers to reject messages that fail authentication and to receive reports on spoofing attempts?