The problem, in plain terms
Email was built without identity checks, and three records were added later to close the gap. SPF is your domain's published list of services allowed to send mail for it. DKIM is a signature your real mail carries. DMARC is the instruction that ties them together: it tells receiving servers what to do with mail that claims to be from your domain but fails the checks, and it sends you reports about who is sending in your name.
Most small business domains fall into one of two exposed states, and the free check above tells you which. Many have no DMARC record at all: receivers get no instructions, so spoofed mail is delivered like real mail. Others have a record set to monitoring only: the reports are collected, but spoofed mail is still delivered, because the domain never moved from watching to enforcing. The second damage is quieter: without these records lining up, receivers cannot trust your real mail either, so your genuine quotes and invoices land in spam.
What the evidence can and cannot show
These records are public, and the check reads exactly what your domain publishes: whether a DMARC record exists, which policy it sets, and whether an SPF record is present. That part is not an estimate; it is your domain's own published state. What the outside view cannot see is the full list of services that send mail for you, your invoicing tool, your website forms, your newsletter service, and that list is what makes enforcement safe. Turning enforcement on blind can block your own legitimate mail, which is why the fix starts with mapping your senders, not with flipping the record.
What the fix involves
The record settings themselves are the paid work, so this page describes the shape of the job, not the recipe. Every engagement runs: map every legitimate sender for the domain from your records and your answers, align SPF and DKIM for each one, publish DMARC with reporting so the remaining gaps show themselves, then move the policy to enforcement (quarantine, then reject) with the reports watched at each step. You receive a written verification record showing the before and after state of each record. Done in this order, your real mail keeps flowing while the spoofed kind starts bouncing.
What it costs
DMARC enforcement for one domain is Fix It, CA$197. If the check also proves website problems, one Secure It job at CA$397 closes everything together. Keeping the reports reviewed afterwards is part of the watch, at the single CA$49 per month rate in the service terms.