For most domains the answer is yes, and the owner thinks otherwise. Publishing a DMARC record is not the same as enforcing one — the most common setting asks receiving servers for reports and then delivers the forged mail anyway.
Free, instant, no signup. This reads public DNS records only — it does not contact your website or your mail server.
A DNS record telling receiving mail servers what to do when a message claims to be from your domain but fails authentication. Without it, they decide for themselves, and they usually deliver.
It asks for reports and nothing more. Forged mail is still delivered. It is a reasonable first step while you find your legitimate senders, and a poor place to stop.
Yes, and more so. A domain nobody sends from is a domain nobody notices being impersonated. Parked and marketing domains are attractive for exactly that reason.
No. Every lookup goes to a public DNS resolver and reads records you published for the world. Your website and mail server are never contacted.