Check whether your domain can be spoofed

Anyone can put your domain in the From: field. What stops the message being delivered is a DMARC policy telling receivers to reject it. This checks whether yours does.

What this means

What actually stops spoofing?

DMARC with p=quarantine or p=reject. SPF and DKIM alone do not — they authenticate a message, but without DMARC there is no published instruction about what to do when authentication fails.

I have DMARC but it says p=none.

p=none is monitoring only. It generates reports and changes nothing about delivery, so spoofed mail still lands. It is the correct first step, not a destination — move to quarantine, then reject, once reports look clean.

Why does this matter commercially?

Invoice fraud and payroll-diversion attacks usually begin with a spoofed message from a domain the recipient trusts. Publishing an enforcing policy is one DNS record.