Domain spoofing

When you setup all the records you mention, this only means the records are setup.

To enforce all these records, the mail system running on your MX records must query/pull all these records + then take correct action to enforce them.

This is fairly complex + can take a bit of time to get working correctly.

Very rarely will a mail system implement all these correctly. Usually you'll have to setup your system for exactly which of these records you'd like to act upon.

Each of the techniques you have set up will increase your "Sender Reputation" according to other spam filters, but don't do a whole lot to prevent spoofing when the To: and From: domain are the same (this would be when a spammer sends messages to your organization and spoofs your domain to do so).

You will want to look through your spam filter settings in the Exchange management portal to see if your domain is included in the list of accepted domains. If it is, remove that white-listing and your problem will stop. If it isn't listed there, check the transport rules to see if there is a rule that sets emails from your domain to bypass spam filtering. Remove that rule if it exists. If there is nothing allowing your domain in either of those, you can try creating a rule that blocked messages originating outside your organization with your domain as the from: address. In general, the only time you would receive messages from outside your organization with your from: address is if you have third party mail systems sending to your environment. You can create exceptions for those systems if you wish.

You can try to create anti spoofing transport rule in Exchange admin center.

https://support.knowbe4.com/hc/en-us/articles/212679977-Domain-Spoof-Prevention-in-Exchange-2013-2016-Office-365