Check DMARC record and policy. Catches missing policy, weak `p=none` mode, and misconfigured reporting.