Three records decide whether someone can send mail in a domain's name. SPF and DKIM say who is allowed to; only DMARC tells the receiving server what to do when neither matches. A domain can carry all three and still reject nothing - that is the ordinary case, not the exception. This reads the records and names which of them are doing work.
Only DNS is queried; nothing is fetched from the entered domain, and no message is sent. The query is protected by reCAPTCHA v3, and the calling IP address together with the domain is stored for one hour to limit the rate - twenty queries per address per hour. Nothing else is kept.