Why it matters
Email was built to trust the name on the envelope. Anybody can write yours.
Nothing in email itself stops a stranger from sending a message that says it comes from your address. The invoice with new bank details, the urgent request to a supplier, the password reset that is not one. Your customers see your name, and they have no reason to doubt it.
What stops it is three short records you publish next to your website, which the large mail services read before they deliver a message. Most owners have never seen them, because whoever set up the website was not asked to.
What we read
Three records, in the words they deserve.
DMARC is the rule. It tells other mail services what to do with a message that claims to be from you and fails the test: deliver it, send it to spam, or refuse it. Without it, or with it set to watch only, fake mail is delivered.
SPF is the list of services allowed to send mail as you, such as your mailbox provider and the tool that sends your newsletters.
DKIM is a signature your mail service puts on each message. Its key is published under a name only your service knows, so we look under the names services commonly use and say plainly when we do not find one.
All three are public. Anyone can read them, which is why this check needs nothing from you but your address, and why we send nothing to it.
The long version, with how to check it yourself: anyone can send email as you until you stop them.
One question answered. The full check asks sixteen.
The free check reads your whole website the way an AI assistant does and tells you, in the same plain words, what it can and cannot do with your business today.