Can someone send email as your business?

Not necessarily. The From field of an email can be faked without any access to your mailbox, the same way anyone can write any return address on an envelope. Look in your Sent folder: if the messages are not there, it is most likely spoofing. A DMARC policy of quarantine or reject stops most of it.

SPF is the list of servers allowed to send mail for your domain. DKIM is a signature on each message that receivers can verify. DMARC ties both to the address people see in the From field and tells receivers what to do when a message fails: nothing, the spam folder, or reject.

p=none only collects reports and delivers everything. p=quarantine sends mail that fails to spam. p=reject tells receivers to refuse it. Only the last two protect you; none is the safe first step while you check that your own mail passes.

Each mail service stores its DKIM key under a name it picks, called a selector, and those names cannot be listed from outside. This check tries the names most services use. To be sure, open a message you sent in Gmail, choose "Show original", and look for DKIM: PASS.

While reading your SPF record, a receiver may look up at most 10 other records, counting the ones inside each include. Past 10 the whole record counts as failed. It happens when services are added over the years; the fix is to remove the ones you no longer use.

You can, but it is risky. If your invoicing tool or newsletter is not set up with SPF or DKIM, its mail will be rejected too. Start with p=none and a report address, read the reports for a few weeks, then move to quarantine and then reject.