Lookalike Domains and Typosquatting: Spot, Monitor, and Defend

When SPF, DKIM, and DMARC make your real domain hard to spoof, attackers stop trying to be you and start trying to be almost you. They register yourcompany-invoices.com, yourc0mpany.com, or yourcompany.co, set up a mailbox, and email your customers and staff from an address that looks right at a glance. Here is how these domains are built, how to find them, and what a small business can realistically do about them.

Quick answer

A lookalike domain is any registered name designed to be mistaken for yours. You cannot stop people registering them, but you can make the impersonation fail: enforce DMARC on your real domain so the real one cannot be faked, register the handful of highest-risk variants yourself, teach staff and customers to check the domain character by character, and report abusive domains to the registrar and the hosting provider.

The variants attackers actually use

• Character swaps and omissions: yourcompnay.com, yourcompny.com.
• Homoglyphs: a zero for an o (yourc0mpany), rn for m (yourcornpany), a capital I for a lowercase l.
• Added words: yourcompany-billing.com, yourcompany-support.net, yourcompanyhq.com.
• Different TLDs: yourcompany.co, .net, .org, or a country code you do not use.
• Hyphen insertion or removal: your-company.com versus yourcompany.com.
• Subdomain tricks on an unrelated domain: yourcompany.com.secure-portal.example, which is a subdomain of secure-portal.example.

How to spot one in an email

1. Read the actual sender address, not the display name. On mobile, tap the name.
2. Read the domain from the right: the part immediately before .com (or the country code) is the real registered name. Everything to the left is a subdomain and can say anything.
3. Compare against a known-good email from the same contact, character by character.
4. Check whether the domain has a website and how old it is. A WHOIS lookup shows the registration date; a domain registered last week claiming to be a supplier you have used for years is not that supplier.

Monitoring for new lookalikes

• Free typosquat generators (dnstwist is the widely used open-source one) produce hundreds of permutations of your domain and check which are registered and which have MX records, meaning they can receive or send mail.
• Run the check quarterly and after any phishing incident. Save the output so you can diff it next time.
• Set up a search alert for your company name plus words like invoice, billing, or support, which sometimes surfaces impersonation pages.
• Watch your DMARC reports. Lookalikes do not appear there (they are different domains), but a spike in failed mail using your real domain often accompanies a lookalike campaign.

Defences ranked by cost and effect

1. Enforce DMARC at p=reject on your real domain. This does nothing against lookalikes directly, but it forces attackers to use a lookalike rather than your exact address, which is easier for people to notice. OquMail sets up SPF, DKIM, and DMARC with live verification when you connect a domain.
2. Register the top variants: the .co, .net and .org of your name, the hyphenated version, and the one or two most plausible typos. Point them at your real site and add an SPF record of v=spf1 -all plus a DMARC record of p=reject to each, so they can neither receive attention nor send mail. OquMail lets you attach up to 3 domains on the free plan if you want mail on more than one.
3. Tell customers, on invoices and in your signature, exactly which domain you send from and that you never change bank details by email.
4. Train staff on the read-from-the-right rule and the phone-verification rule for payments.
5. Report active abuse. Registrars publish abuse contacts (usually abuse@ the registrar's domain), hosting providers do the same, and most browsers accept phishing-site reports.

Records to publish on domains you own but do not use

# On a parked or defensive domain
lookalike-you-own.com          TXT  "v=spf1 -all"
_dmarc.lookalike-you-own.com   TXT  "v=DMARC1; p=reject; rua=mailto:dmarc@yourdomain.com"
# No MX record, or a "null MX": lookalike-you-own.com MX 0 .

Common questions

Can I get a lookalike domain taken down?

Sometimes. Registrars act on clear phishing evidence, and trademark holders have a dispute process (UDRP) for .com and many other TLDs, though it is slower and costs money. Start with abuse reports and screenshots of the impersonation.

How many defensive domains should a small business buy?

Three to five is reasonable: the obvious alternative TLDs and the hyphenated form. Buying every permutation is expensive and attackers will find one you missed; the goal is to remove the easiest options.

Does a lookalike domain hurt my deliverability?

Not directly, because it is a separate domain with its own reputation. It hurts your customers and your brand, which is why the defence is about people and process as much as DNS.