Paste the weekly DMARC aggregate XML you get from Gmail or Microsoft and get a plain-English answer: who is actually sending mail as your domain, how much of it is properly authenticated, and what looks unauthorized.
Gmail: open the DMARC email → download the .xml attachment → paste it. Nothing you paste leaves your browser.