Check your domain
SPF, DMARC, MTA-STS, DNSSEC, DANE and the TLS your mail servers actually present. Free, and it takes about twenty seconds.
What this does not do
This reads public DNS and talks to your mail servers the way any sender would. It cannot see the headers of a message that was actually rejected, and those are what say which of your problems is the one costing you delivery. That is what the audit is for.