Can someone send email as your company?
Fake invoices and "urgent payment" emails work best when they come from your real domain. This checks the DNS records that tell inboxes which email really comes from you, grades them A to F, and gives you the exact records to publish.
SPF
Lists the servers allowed to send your email. One record, at most 10 DNS lookups, ending in -all.
DKIM
Signs each email so receivers can prove it wasn't forged or changed. Your provider turns it on and gives you the record.
DMARC
Tells inboxes to reject email that fails both, and sends you reports. p=reject is the goal; p=none only watches.
What this can and can't tell you
It reads public DNS records, the same ones every mail server reads. It finds and helps fix the common gaps attackers look for; it can't stop every phishing email, and it can't see DKIM selectors outside the common ones. The domain you check and the results aren't stored or logged.