Salesforce's duplicate management has two cooperating parts:
A Matching Rule defines how two records are considered duplicates — which fields are compared and how (exact match, fuzzy match, blank-ignore). For example, a Contact matching rule might say: same Email OR (same First Name fuzzy AND same Last Name exact AND same Company exact). Matching rules don't take action; they're just the comparison logic.
A Duplicate Rule defines what to do when a matching rule fires. Per object, you wire a matching rule into a duplicate rule and configure the action: Allow with alert, Block the save, Report only, or both Block and Report. You also choose when it runs (on Create, on Edit), which record types or profiles it applies to, and which conditions exempt records from being checked.
So the flow on every save is: Salesforce evaluates the duplicate rule's conditions -> if applicable, it runs the matching rule against existing records -> if matches are found, the duplicate rule's action is taken (alert/block/report).
Standard matching rules ship for Account, Contact, and Lead. You can build custom matching rules for any object including custom ones. Up to 5 active matching rules per object. Duplicate Error Logs in Setup let you audit what's been triggering rules.
Practical gotcha: matching rules don't apply to bulk API loads by default — the duplicate rule must opt in to "alert" on bulk operations or the load silently bypasses the check.