Lookalike domain spoofing for beginners: a plain-English guide

The one-sentence version#

Lookalike (cousin) domain spoofing uses a domain visually similar to yours (examp1e.com, example-billing.com) to send mail that passes authentication for the attacker's domain while impersonating your brand.

Why you should care#

DMARC stops exact-domain spoofing, so attackers moved to lookalikes. It is now the dominant brand-impersonation technique.

The mental model#

Think of lookalike domain spoofing as a contract between you and the mailbox providers receiving your mail. You publish or configure something they can check; they check it on every message; the result feeds their decision about where your message lands. Everything below is about making that check pass consistently.

Your first setup, step by step#

1. Register the most obvious typo and hyphen variants of your domain.
2. Monitor new registrations that contain your brand string.
3. Configure inbound gateway rules to flag display names matching executives from external domains.
4. Train finance and executive assistants specifically on this pattern.

Words you will see#

• Mailbox provider: Gmail, Microsoft, Yahoo, Apple, and the corporate gateways that decide where mail lands.
• Authentication: proof that a message is from who it says it is (SPF, DKIM, DMARC).
• Reputation: the provider's running score of your domain and IP.
• Placement: whether a message reaches the inbox, spam, or is rejected.

Common mistakes#

• Assuming DMARC p=reject protects against lookalikes.
• Registering variants but leaving them without DMARC reject themselves.

Frequently asked questions#