Skip to main content
DefendDomain
Under attack?

What DMARC does not stop: lookalike domains

DMARC stops criminals sending email as your exact domain, and you should keep it at p=reject. It cannot see a lookalike domain, such as yourcompany-invoices.com or yourcornpany.com, because the criminal owns that domain and sets up its own email records. We watch around 500 lookalikes of each domain and get the ones used against you taken down.

A common assumption

“We have DMARC at p=reject, so nobody can send email as us.”

In our fake-invoice case, nobody needed to: the emails came from the brand’s name with a product word added.

Already happening?

Report a live attack

Free to report. No account needed. One of our team calls you back, usually the same working day.

Check for lookalike domains

Checks 150+ lookalikes of your domain in a couple of minutes. No account, no card. We email the report to a work address, not Gmail or Outlook.com.

Out of hours, email security@defenddomain.com.

What DMARC protects, and where it stops

DMARC is a DNS record that tells other mail servers what to do with email that claims to come from your exact domain but fails SPF or DKIM.

What DMARC does well

  • Stops direct spoofing of @yourcompany.com
  • Tells receiving servers to reject email that fails SPF or DKIM
  • Sends you reports on who is sending as your domain
  • Protects your domain’s reputation with email providers

What DMARC cannot see

  • Email from a lookalike domain, such as yourcompany-invoices.com
  • Fake websites and copied login pages on those domains
  • Security certificates issued for names that look like yours
  • Changes to your own record: nothing in DMARC warns you if it is weakened

We cover all four, without any change to your DMARC record.

How a lookalike gets past DMARC

Five steps, and none of them touches your domain or your mail servers.

  1. Step 1

    Register a lookalike

    The criminal registers yourcompany-secure.com or yourcornpany.com. Nothing on your side changes, so nothing warns you.

  2. Step 2

    Set up email for it

    They add SPF, DKIM and even their own DMARC record. Their email now passes those checks, because it really does come from their domain.

  3. Step 3

    Copy your look

    Your email signature, logo and invoice layout are copied. If they want logins, your login page is copied too.

  4. Step 4

    Send the email

    Your customer or supplier receives an email from the lookalike, and their filters let some of these through.

  5. Step 5

    Collect the money or the password

    The reader pays a new bank account or types a password into the copy of your page. Unless the lookalike was flagged when it was registered, you hear about it from the customer.

What we add to DMARC

Each check runs from outside your systems, and the website marker on your pages is the only part you add, if you want it.

Lookalikes set up to send email

Around 500 names per domain, checked every hour. One that is registered or gets a mail server is flagged; one that looks set up to attack you raises an alert, with who registered it and where it is hosted already gathered.

A certificate for a copied page

A copied login page needs a certificate before the browser shows a padlock, and every certificate is logged in public. We watch 100+ certificate logs as entries appear.

Your invoice or login page, copied

We search the web for copies of your site’s wording. The website marker (optional, a small script or a 1×1 image) tells us when a copy of a page loads somewhere else.

Your own domains, every day

DMARC, SPF, DKIM, MTA-STS, DNS, certificates and website settings, graded A to F. The free scan does not include this check. How the check works

When one is used against you

You confirm the attack, and one click sends the evidence to up to 12 places: the registrar, the host, the email provider it sends through, an abuse-report network, blocklists and threat feeds, browser warning lists and search engines. For a lookalike that only sends email, the blocklists are what cut delivery of its emails. If they have not acted, we chase the registrar and host again at 48 and 96 hours, then the registry, which runs the domain ending, at 120 and 168 hours. Most takedowns take between 2 and 96 hours, depending on the registrar and host involved.

We check every hour whether it is still online and tell you when it goes down. After that we keep watching and alert you if it comes back. More on how a takedown works.

Case study, mid-2026

Fake invoice domain taken offline

The company, an established e-commerce and wholesale products business, sells to trade customers and online. Posing as a named salesperson, the sender told its customers that payments had moved to a “factoring” company and asked them to reply for the new bank details.

Read the case study
What happened
Offline
  1. Lookalike set up to send email, no website
  2. Same dayOn anti-phishing blocklists, which cut delivery of its emails
  3. Same dayReports to ten places: the email platforms, the reply mailbox, the registrar, the DNS provider and blocklists
  4. LaterThe attacker added another email platform. We reported that too.
  5. The registrar took the domain offline

From the case. Names changed.

DMARC and DefendDomain side by side

They do different jobs.

QuestionDMARCDefendDomain
When it actsDMARC: When an email reaches a mail serverDefendDomain: When a lookalike is registered, gets a website or is set up to send email (checked every hour)
Fake websitesDMARC: Not coveredDefendDomain: We find them and get them taken down
New certificatesDMARC: Not coveredDefendDomain: Watched in public certificate logs as entries appear

Related pages

Questions about DMARC and lookalike domains

No: with DMARC at p=reject, a criminal who wants to email as you has to register a lookalike, which is the part we find and take down.

No: a lookalike never appears in them. It shows up on the watch list we keep for you, or as an alert if it looks set up to attack you.

See the lookalikes your DMARC record cannot see

In a 30-minute demo we show you the lookalikes of your domain that exist today.

  • Which lookalikes of your domain exist now, and which can send email
  • What the daily check of your own domains looks like
  • A clear annual price for your domains

Rather see results first? Run a free scan