Check DMARC record and policy. Catches missing policy, weak p=none mode, and misconfigured reporting.