Set up all three email authentication standards for Microsoft 365 or Google Workspace, and get to p=reject safely.
A practical checklist for hardening a business domain: registrar locks, DNSSEC, CAA, nameserver hygiene.