A lookalike domain that sends mail is a different problem from one that hosts a page. These guides cover sender impersonation, what authentication does and does not cover, and how to read mail records on a variation.
START WITH EMAIL SPOOFING VS LOOKALIKE DOMAIN: FORGED OR REGISTERED?
Email spoofing is a message whose From header names a domain the sender does not control, while a lookalike domain is a registered name that resembles the real one and sends genuine mail from itself.
12 min readSPF, DKIM and DMARC are mechanisms that let a receiving mail server check whether a message really came from the domain it claims, which is a different question from whether that domain deserves to be trusted.
11 min readMX records are the DNS entries that say where a domain's mail is delivered, published by whoever controls the domain, and on a lookalike they mean somebody made the name capable of receiving mail.
11 min readMore sections: Typosquatting, Domain protection, Domain intelligence, Brand protection, Typosquatting patterns.