Who could pretend to be you?
Once your own domain is protected with DMARC, attackers register one that looks the same at a glance: a letter swapped, an l for a 1, .co instead of .com. This builds up to 150 of those and checks which are registered and which have mail servers.
How the variants are made
Other endings (.net, .co, .io, your country's), look-alike letters (rn for m, 0 for o, 1 for l), a letter left out, doubled or swapped, neighbouring keys, hyphens and single-bit flips.
Registered isn't always hostile
Many look-alikes are parked, held by typo collectors or owned by other businesses. Watch the ones with mail servers or your branding. We look up public DNS only; the domain and results aren't stored or logged.