DMARC stops exact-domain spoofing, so attackers moved to lookalikes. It is now the dominant brand-impersonation technique.
Mistake 1: Assuming DMARC p=reject protects against lookalikes#
Why it hurts: this undermines lookalike domain spoofing at the point where mailbox providers make their decision, and it is rarely surfaced by your own tooling until placement drops.
Fix: Register the most obvious typo and hyphen variants of your domain.
Mistake 2: Registering variants but leaving them without DMARC reject themselves#
Why it hurts: this undermines lookalike domain spoofing at the point where mailbox providers make their decision, and it is rarely surfaced by your own tooling until placement drops.
Fix: Monitor new registrations that contain your brand string.
Frequently asked questions#
How many lookalike domains should I register?
The top 10 to 20 variants by likelihood is a reasonable start; monitoring covers the long tail.