What it is
Lookalike domain registration is a leading indicator of wire-fraud pretext staging. The attacker registers <company>-secure.com, <company>llc.net, or <c0mpany>.com (with a zero for the o) roughly 7-14 days before the intended attack, then sets up email records that pass SPF/DKIM/DMARC on the lookalike domain itself. From there, they send authentic-looking mail to targets who weren't explicitly told about the imposter domain.
Why it matters
The lookalike domain gives the attacker a working sender that will not be caught by any of the target firm's inbound mail defenses, no DMARC policy on the parent domain will help, because the mail is not sent from the parent domain, it's sent from the lookalike. Every email defense that operates on sender authentication is bypassed.
The check behind the finding
whois yourfirm-ca.comTry two or three misspellings of your domain and see which are registered.
Closing it
A look-alike cannot be closed from inside your own systems, because it is not yours. What can be done is to know about it early, tell the people it is aimed at, and ask the host to act where it is being used against you. The assessment lists each look-alike with what it is set up to do and gives the steps for each.