Check whether a domain is protected against spoofing: DMARC policy, reporting and alignment. Free DMARC checker from Total Group.
DMARC tells receiving mail servers what to do with email that fails SPF and DKIM checks for your domain, and sends you reports on who is sending as you. It is the main defence against criminals spoofing your domain, and Google, Microsoft and Yahoo now expect it for bulk senders.
Start with p=none to collect reports, fix any legitimate senders that fail, then move to p=quarantine and finally p=reject for full protection.