Checks a domain's SPF record, every include in it, and its DMARC policy, straight from DNS.
SPF lists the servers allowed to send email for a domain. DMARC tells receivers what to do with mail that fails the checks, and where to send reports. Without both, anyone can send email that claims to come from you.
Good to know
A TXT record starting v=spf1 that lists the servers allowed to send email for the domain. A receiving server checks the sender against it. It ends with what to do about everyone else: -all refuse, ~all mark as suspicious.
A TXT record at _dmarc. the domain that tells receivers what to do with mail failing both SPF and DKIM: deliver it anyway (p=none), treat it as spam (quarantine) or refuse it (reject). It also says where to send daily reports (rua).
DKIM signs each message with a key published in DNS under a name the sender picks (a "selector"), so it can't be checked without knowing that name. Your email provider's setup page gives the record to add.
Every include, a, mx, ptr, exists and redirect costs a lookup, and so do the ones inside each include. Remove services you no longer use, and replace a and mx with the ip4 addresses they stand for.