Look up the SPF and DMARC records published for any domain. Since February 2024, Gmail and Yahoo require both — plus DKIM signing and From-header alignment — from anyone sending more than 5,000 messages a day to their users.
SPF lists which servers are allowed to send mail using your domain. It is a single TXT record on the domain itself, starting v=spf1. You can only have one; if you use several sending services, they go in the same record as multiple include: terms.
DKIM attaches a cryptographic signature to each message so receivers can confirm it was not altered and really came from you. It is published as CNAME or TXT records under _domainkey, one per selector, so multiple providers coexist fine.
DMARC tells receivers what to do when SPF and DKIM fail, and where to send reports. It is a TXT record at _dmarc.yourdomain starting v=DMARC1.
Start at p=none, which monitors without affecting delivery, and read the aggregate reports for a few weeks. Once you are confident every legitimate source of mail for your domain passes, move to p=quarantine and then p=reject.
Going straight to reject before you have identified every system that sends as you — your CRM, your invoicing tool, your helpdesk — will silently drop real mail.