SPF, DKIM, DMARC, MX, BIMI, MTA-STS, TLS-RPT. Checking each record separately takes a while, and the problems are often in how they interact.

The uChecker email domain health check tests the whole set at once, gives a 0 to 100 setup score and sorts what to fix by priority. It is free and runs in the browser.

It is worth running before a big campaign and again after any DNS change, since a small edit in one record can quietly break another.