Someone is almost certainly sending email that looks like it comes from your domain. Most companies have no way to find out. This shows you — every service, every server, every impersonation attempt.
No account. Results in about three seconds.
SPF, DKIM, DMARC. This needs nothing from you — which also means anyone else can see exactly the same thing.
Monitoring only. It does not change how your mail is delivered or filtered. Nothing about your email changes.
Every service sending as you, what authenticated, what was forged, and what to do about it.