Email domain spoofing is when an attacker sends email that appears to come from your organization, either by forging your exact domain in the "From" header or by sending from a lookalike domain that is nearly identical to yours. Proper authentication (SPF, DKIM, and DMARC) can block the first kind. The second kind is harder to stop and is the engine behind most business email compromise (BEC) fraud, because the attacker owns a real domain that passes every authentication check.
The rest of this guide explains how lookalike domains are built, why they get past filters and people, and how to find them before they're used against your customers, staff, or suppliers.
What Email Domain Spoofing Actually Covers
There are three distinct techniques, and they need different defenses:
- Exact-domain spoofing: The attacker forges your real domain (say, example.com) in the From header. If you publish a DMARC policy of p=reject, receiving mail servers that honor it will refuse these messages.
- Display-name spoofing: The sender's visible name says "Finance Team, Example Corp," but the underlying address is an unrelated free mailbox. It works because many mail apps, especially on phones, show only the display name.
- Lookalike (cousin) domain spoofing: The attacker registers a domain that resembles yours and sends from it. DMARC on your domain does nothing here, because the mail isn't using your domain at all.
That last category is why DMARC on its own doesn't solve email domain spoofing. Once you lock down your exact domain, attackers move to domains you don't control.
How Lookalike Domains Are Built
Attackers generate dozens or hundreds of permutations of a target brand and register the ones that are available and convincing. The common patterns:
Character substitution and omission
Swapping visually similar characters, such as the digit 1 for a lowercase l, rn for m, or 0 for o. Dropping or doubling a letter works too. In a fast scan of an inbox, a missing letter in example.com rarely registers.
Homoglyphs and IDN domains
Internationalized domain names (IDNs) allow non-Latin characters. A Cyrillic "а" looks identical to a Latin "a" in most fonts, so an attacker can register a domain that renders exactly like example.com but is a different domain underneath. Its true form is a punycode string beginning with "xn--". Some clients display the punycode, but many don't.
TLD swaps
Same brand name, different top-level domain. If you own example.com, an attacker registers example.net or example.org, or a country-code or newer gTLD. Recipients tend to read the brand name and skip the ending.
Combosquatting
The brand name plus a plausible word: "billing," "secure," "invoice," "hr," "support," joined with or without a hyphen. These don't rely on typos at all. They look like a legitimate department or service domain, which makes them effective in invoice and payroll scams.
Subdomain tricks
The attacker owns example.net and creates the subdomain example.com.example.net. In a From address or link, the reader sees "example.com" at the start and stops reading.
Why Lookalike Domains Beat Email Security
The attacker owns the lookalike domain outright, so they can configure it properly:
- They publish MX records so the domain can send and receive mail, which lets victims reply straight to the attacker.
- They set up valid SPF and DKIM records, so messages pass authentication and often pass DMARC for their own domain.
- They obtain a free TLS certificate so any accompanying phishing page shows a padlock.
- They often let the domain sit unused for a while, since freshly registered domains attract more suspicion from filters.
To a mail gateway, this looks like legitimate mail from a properly configured domain. The only real difference is a character or two, and filters can't judge visual similarity to your brand unless they've been told your brand exists.## How to Spot and Stop Lookalike Domain Attacks
In a typical BEC scheme, the attacker researches who approves payments, then emails from a lookalike domain posing as an executive, vendor, or law firm. The request is usually urgent and routine-sounding: updated bank details, a pending invoice, a gift card purchase, a payroll change. Because replies land in the attacker's mailbox, they can carry on a convincing back-and-forth thread. Defending against this takes process, configuration, and visibility into domains you don't own.
- Verify payment changes out of band. Any request to change bank details or send funds gets confirmed by phone, using a number already on file, never one from the email. This single control defeats most BEC attempts regardless of how good the domain looks.
- Enforce DMARC at p=reject on every domain you own, including parked ones that never send mail. This closes off exact-domain spoofing and pushes attackers toward lookalikes you can then hunt down.
- Flag external senders. Configure your mail system to tag messages from outside your organization, and display full sender addresses rather than display names alone.
- Train staff on the specific patterns in this guide: TLD swaps, combosquatted department names, and subdomains that start with your brand. Concrete examples stick better than generic phishing warnings.
- Defensively register your highest-risk variants, such as common typos and the main TLDs for your brand name. You can't register every permutation, so focus on the ones closest to your real domain.
- Monitor for new lookalikes continuously. This is the step most organizations skip. Dokyma handles it for you: a scan at dokyma.com generates permutations of your domain (substitutions, homoglyphs, TLD swaps, combosquats), checks which are registered, inspects their DNS and WHOIS data for MX records that signal email capability, and watches certificate transparency logs for newly issued TLS certificates on domains impersonating your brand.
When a lookalike turns up, warn finance and any vendors or customers it could target. Add the domain to your mail blocklist, and file abuse reports with the registrar and hosting provider. If the domain has an MX record, treat it as an active email threat rather than a parked curiosity.
To see what already exists, run a free brand scan at dokyma.com. Enter your primary domain, and the results show which lookalike and typosquat domains are registered today, which ones can send email, and which have fresh certificates. That gives you a prioritized list of what to block, report, and warn your team about before someone acts on a fake invoice.