Can someone send an invoice as you?
Four public records decide it. Most business domains we check leave the door open. Yours takes about five seconds to read.
Delivered is not the same as trusted
Mail that fails these checks does not usually bounce. It arrives in spam, which is worse, because nothing tells you it happened. Quotes, invoices and password resets quietly stop landing and the first you hear of it is a client saying they never got anything.
The other half is forgery. Without a DMARC policy, anyone can put your domain in the From line and send an invoice with their own bank details on it. The recipient sees your name. This is the commonest way small businesses lose money to fraud, and the fix is a DNS record.
We learned this on our own domain. Authentication was not the headline problem: SPF aligned, a DKIM key was published, MX was correct, and mail was still filed as spam because the policy said to do nothing about failures and no reports were being collected. The tool above checks the same four things we had to work through.
We can fix these, usually in a day.
They are DNS changes rather than a rebuild, and they come as part of any web or SEO work we do. If that is all you need, it is all you pay for.