Why this is possible at all
Email was designed in the early 1980s without any way to prove who sent a message. The From line is text. Anyone can type anything into it, and the protocol has no opinion about whether it is true.
Three DNS records were added later to patch that. SPF lists the servers allowed to send for your domain. DKIM cryptographically signs what you send. DMARC is the one that matters most, because it tells receiving servers what to do when a message fails those checks, and without it the usual answer is to deliver it anyway.
Most small companies have none of this, or have a DMARC record left in monitoring mode from the day it was set up. That is not negligence. It is a genuinely obscure corner of infrastructure that nobody owns at a company of five people.
What it is actually used for
The common attack is dull and effective: a supplier invoice arrives with changed bank details, from an address the recipient recognises. It works because there is nothing to notice. The domain is genuine, the display name is right, and the only thing wrong is the account number.
The second use is quieter. Your own legitimate email is more likely to be filtered when your domain has no authentication, because the same records are what receiving servers use to decide you are trustworthy. Fixing this is one of very few deliverability changes with a direct mechanical effect rather than folklore.
Questions
What does it mean that anyone can send email as my domain?
Email has no built-in proof of who sent it. The From line is just text, so anyone can type your address into it. Three DNS records exist to fix that: SPF lists which servers may send for you, DKIM signs your outgoing mail, and DMARC tells receiving servers what to do when something fails those checks. Without DMARC set to quarantine or reject, a forged message is usually delivered.
Is my domain really unprotected, or is this a scare tactic?
Check the DMARC line in your result. If it says no record, or a policy of p=none, then forged mail claiming to be you is not being blocked, and that is a fact about your DNS rather than an opinion. The raw record is shown underneath so you can verify it yourself with any DNS lookup tool.
Why does p=none not protect me?
Because it means monitor only. The receiving server checks the message, notices it is forged, and delivers it anyway, because that is what your policy instructs. It is the standard starting point when DMARC is set up, and most domains are left there and never moved to quarantine or reject.
You said no DKIM key found. Do I definitely not have one?
No, and we say so on the result. DKIM keys live at a name chosen by your email provider, called a selector, and there is no way to list them. We try the common ones. Finding nothing means we could not guess yours, not that you have none. Your email provider can tell you in a minute.
Will fixing this stop my email going to spam?
It helps, often a lot. The same three records are used by receiving servers to decide whether you are trustworthy, so a domain with no authentication is more likely to be filtered. Fixing them is one of the few deliverability changes with a direct, mechanical effect rather than a folk remedy.
Do you store my domain or send anything?
No. It reads public DNS records, the same ones anyone can query, and returns the result. Nothing is stored and no email is sent at any point. The example message on the results page is drawn in your browser as an illustration.