What GDPR and ePrivacy requires#
GDPR requires a lawful basis (usually consent) for marketing email and documented consent records.
What lookalike domain spoofing is#
Lookalike (cousin) domain spoofing uses a domain visually similar to yours (examp1e.com, example-billing.com) to send mail that passes authentication for the attacker's domain while impersonating your brand.
Why it matters#
DMARC stops exact-domain spoofing, so attackers moved to lookalikes. It is now the dominant brand-impersonation technique.
How lookalike domain spoofing supports GDPR and ePrivacy compliance#
Regulators and recipients need to identify who sent a message and trust that opt-out mechanisms work. Lookalike domain spoofing contributes by dMARC stops exact-domain spoofing, so attackers moved to lookalikes. It is now the dominant brand-impersonation technique.
Implementation steps#
- Register the most obvious typo and hyphen variants of your domain.
- Monitor new registrations that contain your brand string.
- Configure inbound gateway rules to flag display names matching executives from external domains.
- Train finance and executive assistants specifically on this pattern.
Frequently asked questions#
How many lookalike domains should I register?
The top 10 to 20 variants by likelihood is a reasonable start; monitoring covers the long tail.