Closing a gap the original protocol never addressed
Sender domain authentication verifies that a message claiming to come from a particular domain was actually authorized, by that domain's own published policy, to be sent on its behalf. The underlying email protocol never guaranteed this on its own — a message's claimed sender has historically been trivial to forge, which is exactly what made phishing that impersonates a trusted domain so effective for so long, and exactly the gap domain authentication was built to close.
A domain publishes, in a place any receiving mail server can check, which sending sources are actually authorized to send on its behalf; a receiving server checks an incoming message against that published policy and can reject, flag, or quarantine anything claiming to be from a domain that never actually authorized it to send that message.
This is a specific instance of a much older idea: an open relay, guarded
This connects directly to the open relay problem covered elsewhere: an open relay forwards mail for anyone without checking whether the sender was actually authorized to route through it, and domain-based authentication is, in effect, the recipient side's version of the same discipline — checking whether a message's claimed origin was actually authorized to send it, rather than trusting that a message reaching an inbox at all implies it's legitimate.