Domain hygiene

How hard is it to impersonate this domain? SPF, DMARC and DNSSEC decide whether forged mail and forged DNS answers get rejected or delivered. We read the records the domain publishes — we never connect to its servers.