NevTan Mail is secure, ad-free business email on your own custom domain, with a built-in calendar, meetings, admin and role-based controls, TLS-encrypted connections, and guided SPF/DKIM/DMARC setup. This guide explains how criminals register domains that look almost identical to yours, use them to invoice your customers and defraud your staff, and why the email authentication you already set up does nothing to stop them. You will learn the six techniques attackers use, how to find the lookalikes already registered against your brand, and what to do about each one. For context on the platform itself, start with our complete NevTan Mail platform guide.
A lookalike domain is a domain registered to resemble yours — acrne.com for acme.com, acme-invoices.com, acme.co — and used to impersonate your business in email. SPF, DKIM, and DMARC cannot stop these attacks, because the attacker owns the domain they are sending from and can authenticate it perfectly. Protection requires four separate layers: defensive registration of the highest-risk variants, continuous monitoring of new registrations and TLS certificates, inbound filtering that flags near-miss sender domains, and out-of-band payment verification that does not rely on email at all.
Why Email Authentication Does Not Solve This
This is the single most important thing to understand, and most guides on the subject get it wrong by omission.
SPF, DKIM, and DMARC protect your exact domain. They tell receiving servers which systems are permitted to send as acme.com, and what to do with mail that claims to be from acme.com but fails those checks. If you have published a DMARC record at p=reject, an attacker genuinely cannot spoof acme.com in the From address and reach an inbox. That protection is real, and if you have not set it up yet, our guide to domain authentication and why business emails land in spam walks through it.
But a lookalike attack never claims to be acme.com. It claims to be acrne.com — a domain the attacker registered, controls, and can configure with its own perfectly valid SPF, DKIM, and DMARC records. The mail passes every authentication check, because it is authentically from acrne.com. Authentication asks "did this domain really send this?" It does not ask "is this domain pretending to be someone else?"
That gap is why lookalike domains have become the dominant impersonation method rather than a fallback. Abnormal's 2026 Attack Landscape Report, based on an analysis of nearly 800,000 email attacks, found that roughly 61% of business email compromise involves impersonating an external third party rather than someone inside the organization — and that for invoice inquiry attacks specifically, 98.1% used impersonation while under 1% involved a genuinely compromised vendor account. Registering a domain costs about $10. Compromising a real mailbox is work. When a lookalike works just as well, attackers stop breaking in.
The financial scale is documented. The FBI's Internet Crime Complaint Center recorded 24,768 business email compromise complaints in 2025 totalling $3,046,598,558 in reported losses, making BEC the second-highest loss category in its 2025 Internet Crime Report, behind only investment fraud. Total reported cybercrime losses reached $20.877 billion, a 26% increase over 2024.
What You Need Before Starting
Before you can protect your brand, you need four things in hand.
First, a complete inventory of the domains you already own, including ones registered years ago for campaigns, redirects, or country variants. Many organisations discover during this exercise that they own domains nobody is monitoring and that have long since dropped their DNS records — an abandoned domain that still appears in old email signatures is a gift to an attacker who re-registers it when it expires.
Second, a registered trademark, or at minimum documented common-law rights in your business name. Almost every takedown route — UDRP, URS, registrar abuse complaints — turns on your ability to demonstrate rights in the name. Without a trademark, your options narrow sharply to buying the domain or waiting for it to lapse.
Third, administrative access to your DNS and your email platform, because several of the controls below are configured there. If you have not yet moved your mail onto your own domain, start with our guide to business email on your own domain.
Fourth, a written payment verification procedure — or the acknowledgement that you do not have one. This is the control that actually stops the loss when every technical layer fails, and it is the one most small businesses skip.
The Six Techniques Attackers Use
Lookalike domains are not one tactic. They are six, and they defeat different defences.
1. Typosquatting relies on fingers slipping: acme.com becomes acem.com, acme.cm, or acne.com. These catch mistyped addresses and misread sender lines, and they are the cheapest variants to register in bulk.
2. Homoglyph and homograph attacks substitute characters that render almost identically. The classic is replacing "rn" with "m" — acrne.com is genuinely difficult to distinguish from acme.com in a standard sans-serif font at normal size. The internationalised version substitutes Unicode characters from other scripts: a Cyrillic "а" (U+0430) is visually indistinguishable from a Latin "a" in most typefaces, producing a domain that is a completely different string at the DNS level while looking identical on screen. Flare's research reported that 75% of homoglyph domains targeting Global 2000 brands are registered to unrelated third parties.
3. Combosquatting appends a plausible word rather than altering your name at all: acme-invoices.com, acme-billing.com, acmepayments.com, acme-support.com. This is the hardest category to defend against by registration, because the combinations are effectively unlimited, and it is the most effective against recipients, because the domain reads like a legitimate departmental subdomain.
4. TLD swapping keeps your name exactly and changes only the extension: acme.co, acme.net, acme.biz, acme.io, acme.online. The .co variant is especially effective against .com owners, since a single dropped character produces it.
5. Subdomain impersonation puts your brand in a position where it looks like the registered domain but is not: acme.com.secure-billing.net is controlled by whoever owns secure-billing.net, not by you. Recipients scanning left to right see "acme.com" and stop reading.
6. Display-name spoofing with a throwaway domain does not bother disguising the domain at all. The From header reads "Acme Accounts Payable" while the actual address is something unrelated — because most mobile mail clients show only the display name by default. This costs nothing and requires no lookalike registration whatsoever.
Step-by-Step Guide
Step 1: Audit the Lookalikes Already Registered Against You
Start with what exists, not what might. Generate the obvious permutations of your domain — character swaps, doubled and dropped letters, adjacent-key typos, the rn/m and l/I substitutions, your name across the twenty most common TLDs, and your name combined with billing, invoice, pay, support, secure, login, and mail.
Then check each one. A registered variant is not automatically malicious; plenty are held by domain investors or unrelated businesses. What you are looking for is the subset that matters: variants with MX records configured (someone intends to receive or send mail), variants with a recently issued TLS certificate (someone is building a website), variants resolving to a page that copies your branding, and variants registered behind privacy protection shortly after a public announcement about your company.
Pro Tip: Certificate Transparency logs are the highest-signal free source available. Every publicly trusted TLS certificate issued for any domain is recorded in an append-only public log, by design, so that issuance can be audited. Searching those logs for certificates containing your brand string will surface lookalike infrastructure at the moment it is provisioned — usually days or weeks before any phishing email is sent from it.
Step 2: Register the Variants That Actually Matter
You cannot register your way out of this problem. There are well over a thousand top-level domains and effectively infinite combosquatting permutations, and 9.1 million net new domains were registered globally in a single quarter of 2026 according to Flare's figures. Attempting comprehensive defensive registration is a budget with no ceiling.
Register selectively instead. The variants worth owning are: your exact name in .com, .net, and .org regardless of which you use; your exact name in your primary country-code TLD; the two or three character substitutions that are genuinely hard to read at a glance (the rn/m case, doubled letters in your name); and your name in any TLD your industry treats as credible. For most small businesses that is eight to fifteen domains, which at $10–15 each is a rounding error against a single diverted invoice. If budget is genuinely tight, our guide to cheap business email for startups covers how to prioritise spend across domains and mailboxes.
Pro Tip: Point every defensive domain at a redirect to your real site and publish a null SPF record (
v=spf1 -all) plus a DMARC record atp=rejecton each one. A parked domain with no SPF record is a domain an attacker can spoof freely, and because you are not sending from it, there is no risk in locking it down completely.
Step 3: Harden Your Own Domain So Only the Lookalikes Remain
This step does not stop lookalike attacks, but it eliminates the easier attack so that criminals are forced into the harder one — and the harder one leaves more evidence.
Publish SPF, DKIM, and DMARC on your sending domain and move DMARC to enforcement, not monitoring. A policy of p=none satisfies the letter of the major providers' requirements while providing no protection against spoofing; since February 2024 Google has required senders of 5,000 or more messages per day to Gmail to publish a DMARC record and pass SPF or DKIM alignment, Yahoo matched those requirements, and Microsoft began rejecting non-compliant bulk mail outright in May 2025. Publish p=none, review your aggregate reports for two to four weeks until you can account for every legitimate sender, then move to p=quarantine and on to p=reject.
Extend the same treatment to every domain you own that does not send mail, including the defensive registrations from Step 2 and any parked or retired domains. NevTan Mail generates and verifies all of these records for you during setup, and you can manage policies for multiple domains from one admin panel — see the features page for how domain and role management is structured. Our email deliverability best practices cover the sending side of the same configuration.
Step 4: Configure Inbound Detection for Near-Miss Senders
Your outbound records protect your recipients. This step protects your own staff, who are the target of vendor impersonation.
Configure your mail platform to flag external senders whose domain is a close string match to your own or to a known vendor, and to display an external-sender banner on all mail originating outside your organisation. Make the full email address visible rather than just the display name wherever your client allows it, since display-name spoofing depends entirely on that address being hidden. Where your platform supports it, flag first-contact senders — a domain that has never emailed your organisation before and is now discussing an invoice deserves scrutiny.
Do not assume your filter catches this. KnowBe4's eighth Phishing Threat Trends Report, published in October 2026, found that 41.3% of phishing emails bypassed secure email gateways, peaking at 48.3% in July 2026, in part because modern campaigns increasingly use real domains and valid certificates that lookalike-detection heuristics were never designed to catch. Filtering reduces volume; it does not close the gap. For the broader security picture, see our explainer on phishing protection and TLS encryption.
Pro Tip: Audit your out-of-office replies. An automatic reply that names who is covering while someone is away, and when they return, is precisely the intelligence a vendor-impersonation attacker needs to time a payment request for a week when the approver is unreachable. Keep auto-replies generic — our guide to out-of-office automation covers how to stay helpful without broadcasting your approval chain.
Step 5: Build the Verification Step That Does Not Use Email
Every control above can fail. This one is what prevents the loss when they do.
Write a rule that any change to payment details — a new bank account, a new remittance address, a change to an existing vendor's details — is verified by calling the vendor on a phone number you already hold on file, never a number supplied in the email requesting the change. Apply the same rule to any payment request above a threshold you set. Require a second approver for both. The entire category of attack depends on the request being validated inside the same channel it arrived in, so breaking that loop breaks the attack regardless of how convincing the domain looked.
Put the procedure in writing, give it to everyone who can move money, and rehearse it once. Keeping it alongside your team's shared calendar and task workspace rather than in a document nobody opens makes it far more likely to be followed under pressure.
Pro Tip: Tell your customers what you will never do. A short line on your invoices and in your email footer — "We will never email you to change our bank details; call us on the number on your contract to verify any such request" — costs nothing and shifts the attack from plausible to obviously wrong.
Real Example
In October 2025, someone registered microsoftofice[.]cz. The domain drops a single "f" from "office" — a near-invisible omission in running text.
It sat dormant. Reputation services did not flag it. According to Flare's analysis published in November 2026, the domain remained largely undetected for roughly a year despite being live, and was eventually found to be the entry point for a targeted Czech-language ClickFix campaign against a Czech company, positioned as that company's IT department.
The detail that matters for anyone reading this as a business owner is what the domain's DNS looked like. Its MX record pointed to Microsoft's Exchange Online infrastructure. Its SPF policy authorised Exchange Online. It carried a Microsoft domain-verification TXT record. In other words, the attacker had set up the lookalike domain on a legitimate business email platform and configured it properly — so mail sent from it authenticated cleanly, arrived from genuine Microsoft infrastructure, and passed every check a receiving server could apply to it.
No amount of authentication on the real microsoft.com would have affected that campaign by one message. The attack did not touch microsoft.com. It is the clearest available illustration of why the four layers above are separate problems requiring separate answers.
How to Choose Your Response to a Lookalike You Find
Not every lookalike warrants the same action, and the costs differ by an order of magnitude.
If the domain is registered but dormant — no MX records, no certificate, no content — log it and monitor. Acting prematurely alerts the registrant that you are watching and can trigger a price demand.
If it is parked with advertising or offered for sale and you have budget, a quiet purchase through a broker is often cheapest. Approaching as a brand with trademark rights invites a markup, so this is one of the few cases where anonymity works in your favour.
If it is actively phishing, go to the hosting provider and registrar abuse teams first. A live credential-harvesting page violates virtually every registrar's acceptable use policy, and takedown through abuse channels is measured in hours or days and costs nothing. Report it to the relevant national cybercrime body in parallel, and if customer data may have been captured, notify affected customers directly — do not rely on a notice on your website.
If you want ownership of the domain itself and you hold trademark rights, the UDRP is the established route. WIPO's filing fee is $1,500 for one to five domain names decided by a single panelist and $2,000 for six to ten, with a three-member panel at $4,000. Since March 2026, WIPO has also offered an expedited track for one to five domains at $4,000 with a target decision within about one month. The Forum charges $1,330 and the Czech Arbitration Court starts around €800 for a comparable single-domain case. Attorney representation is separate and commonly quoted as a flat fee in the $3,000–$7,000 range, so budget the provider fee plus counsel. One practical note: if the same registrant holds several infringing domains, bundling them into a single complaint is substantially cheaper than filing separately.
If the registrant has a legitimate competing claim — a genuine business with a similar name, in a different sector — the UDRP will not help you, and pursuing it risks a finding of reverse domain name hijacking. Verify first.
Explanation: Why This Problem Is Structural
Three structural features of the domain system make lookalike impersonation permanently viable, and understanding them clarifies which defences are worth investing in.
The first is that domain registration is deliberately open and cheap. Anyone can register any available string for roughly the price of a coffee, in minutes, with minimal verification, and registrars compete on frictionlessness. The volume this produces is the problem: Flare recorded more than 30,000 lookalike domains targeting just the 500 most-visited websites in a six-month window, and the APWG logged 971,181 phishing attacks in the first quarter of 2026 alone. No monitoring programme reviews that volume manually, and no registration strategy outpaces it.
The second is that the namespace is visually ambiguous by design. Internationalised domain names exist for a sound reason — people should be able to register domains in their own scripts — but the consequence is that visually identical strings can be entirely different domains. Browsers and mail clients mitigate this by displaying Punycode for mixed-script domains, but that mitigation applies inconsistently across clients, and it does nothing at all for single-script homoglyphs like the rn/m substitution, which uses only ASCII characters and is therefore completely legitimate at every technical layer.
The third, and most consequential, is that email authentication authenticates domains, not identities or intentions. This is not a flaw in SPF, DKIM, or DMARC; it is their specification. They answer whether a message genuinely originated from the domain in the From header. There is no protocol layer that answers whether that domain is attempting to pass as another, because that is a judgement about human perception and trademark rights, not a cryptographic property. Any control that addresses it has to live outside the authentication stack — in monitoring, in filtering heuristics, in legal process, or in a phone call.
A fourth factor is accelerating the first three. The FBI's 2025 report included a section on AI-enabled cybercrime for the first time, logging 22,364 complaints accounting for over $893 million in losses, and attributed more than $30 million of 2025's BEC losses specifically to schemes with a confirmed AI connection. The practical effect on lookalike attacks is that the limiting factor used to be writing a convincing email in the target's language and register; that constraint is gone. Our piece on how AI is changing the inbox covers both sides of that shift.
Common Mistakes to Avoid
Mistake 1: Believing DMARC at p=reject has solved domain impersonation. It has solved exact-domain spoofing, which is a different and narrower problem. Teams that stop here are frequently the most confident and the least protected, because they have been told authentication is the answer and have no monitoring in place at all. Solution: Treat enforcement as table stakes and budget separately for monitoring and verification.
Mistake 2: Attempting comprehensive defensive registration. Buying hundreds of variants burns budget on combinations attackers were never going to use while leaving the combosquatting space — which is unbounded — wide open. Solution: Register the eight to fifteen highest-risk variants and spend the remainder on detection.
Mistake 3: Leaving parked and retired domains unprotected. A domain you own but do not send from, with no SPF or DMARC record, can be spoofed by anyone. Old campaign domains and acquired brands are the usual offenders. Solution: Publish v=spf1 -all and p=reject on every non-sending domain you own, and set calendar reminders for renewal dates.
Mistake 4: Verifying a suspicious request by replying to it. Replying to a lookalike domain reaches the attacker, who will confirm the details enthusiastically. This is the most common single point of failure in documented BEC losses. Solution: Verify by phone, using a number from your own records.
Mistake 5: Telling staff to "check the sender address" and calling it training. Against a Cyrillic homoglyph or an rn/m substitution, visual inspection does not work, and instructing people to rely on it teaches false confidence. Solution: Train on process — verify payment changes out of band, always — rather than on detection.
Mistake 6: Ignoring impersonation of your marketing mail. Lookalike domains are used to send fake promotions and fake order confirmations to your customers, damaging your brand and your sender reputation simultaneously. If you send campaigns, keep them on separate sending infrastructure from your business correspondence so one does not contaminate the other — our breakdown of transactional vs marketing emails explains the separation, and why emails go to spam covers the reputation damage.
Frequently Asked Questions
What is a lookalike domain?
A lookalike domain is a domain name registered to closely resemble a legitimate organisation's domain, used to impersonate that organisation in email or on the web. Examples include character substitutions (acrne.com for acme.com), added words (acme-invoices.com), and alternative extensions (acme.co). Because the attacker owns and controls the domain, mail sent from it can pass SPF, DKIM, and DMARC checks normally.
Does DMARC stop lookalike domain attacks?
No. DMARC prevents attackers from spoofing your exact domain in the From address, which is valuable and worth implementing. It has no effect on a different domain that merely resembles yours, because the attacker can publish their own valid SPF, DKIM, and DMARC records for the domain they registered. Protecting against lookalikes requires monitoring, inbound filtering, and out-of-band verification in addition to authentication.
How do I find lookalike domains targeting my business?
Generate permutations of your domain (typos, character substitutions, added keywords, alternative TLDs), then check which are registered and which show signs of intent — MX records, recently issued TLS certificates, or cloned branding. Certificate Transparency logs are a free, high-signal source, since every publicly trusted certificate issued for any domain is recorded in a public append-only log.
How much does it cost to take down a lookalike domain?
It depends on the route. Registrar and host abuse complaints against an actively phishing site are free and typically resolve in hours or days. A UDRP complaint to obtain the domain costs $1,500 in WIPO provider fees for one to five domains with a single panelist, $1,330 at the Forum, or around €800 at the Czech Arbitration Court, with attorney fees commonly quoted separately at $3,000–$7,000. WIPO's expedited one-month track is $4,000.
Should I register every possible variation of my domain?
No — the combinations are effectively unlimited and new TLDs keep appearing. Register your exact name across the major generic TLDs and your primary country-code TLD, plus the few character substitutions that are genuinely hard to read. Then invest the remaining budget in monitoring, which scales where registration does not.
How common is business email compromise?
The FBI's Internet Crime Complaint Center recorded 24,768 BEC complaints and $3,046,598,558 in reported losses in 2025, up from 21,442 complaints and $2.77 billion in 2024. BEC was the second-highest loss category in the 2025 Internet Crime Report. Because IC3 figures reflect only complaints that victims chose to file, they understate the true total.
What is a homograph attack?
A homograph attack uses characters that render identically or near-identically to the ones they replace. This can be cross-script — substituting a Cyrillic "а" for a Latin "a" produces a visually identical but technically different domain — or within ASCII, such as replacing "rn" with "m". Browsers display Punycode for some mixed-script domains, but that protection is inconsistent and does not apply to single-script substitutions.
Will moving to a secure email provider stop domain impersonation?
It will close the part of the problem that is yours to close: correctly configured authentication on your own domain, enforced DMARC across every domain you own, inbound filtering and external-sender warnings, and role-based controls limiting who can change DNS or payment-relevant settings. It cannot prevent someone registering a similar domain, which is why monitoring and out-of-band payment verification remain necessary regardless of provider.
Protect Your Domain With NevTan Mail
Lookalike domains exploit the gap between what email authentication proves and what recipients assume. Closing that gap starts with getting your own domain's configuration right, and that is what NevTan Mail is built to make straightforward: guided SPF, DKIM, and DMARC setup with automatic verification, support for multiple domains including parked and defensive registrations, TLS-encrypted connections, and role-based admin controls so only the people who should be able to change DNS or billing settings can.
You also get secure, ad-free business email on your own domain with a calendar and meetings built into the inbox, OAuth migration from your current provider without downtime, and a strict no-ads, no-data-selling policy — the specifics of how we handle your data are set out in our privacy policy, and plan and billing terms in our terms of service. For the reasoning behind how we build, see the principles behind the product.
Technical configuration is one layer of four. Pair it with monitoring, inbound detection, and a payment verification rule that never relies on email, and the attack that costs businesses more than $3 billion a year stops working against yours. For more on securing your mail, read our guides to email encryption for business and why teams are moving to modern webmail, or, if you are connecting applications to your mail, our comparison of IMAP, SMTP, and API integrations. Browse everything on the NevTan Mail blog.
Ready to get your domain properly configured? Start your free trial with NevTan Mail today and have authentication verified across every domain you own in an afternoon.
