How to Stop Lookalike Domain Attacks (Names vs Spoofing)

Lookalike domain attacks succeed when a registered domain is close enough to yours that a busy human trusts it — even when authentication for that attacker domain passes. Domain spoofing forges your exact address. DMARC at enforcement stops much of the latter; it does not stop the former.

When finance receives a fake supplier email, the first question should be: was that our domain or something that only looked like it? Mixing the two leads to bad spending: buying logo features before authentication, or believing p=reject makes lookalike fraud impossible.

How to stop lookalike domain attacks

There is no single DNS switch that blocks every cousin domain. A practical programme stacks five layers:

1. Payment and process controls (highest ROI for fraud loss)
2. Human verification habits (full From domain, not display name)
3. Lookalike domain monitoring (new registrations near your brand)
4. Selective defensive registration (obvious typos and TLD swaps)
5. DMARC enforcement on your domains (removes exact-domain spoof noise so lookalikes stand out)

1. Payment verification and process controls

These stop losses even when the email looks perfect:

• Verify bank detail changes on a known phone number, never only on the email thread
• Dual control for new beneficiaries and large EFTs
• Cool-off periods for banking changes
• Written supplier rule: “we will never change banking details by email alone”
• Treat “urgent same-day payment” plus new bank details as a stop-and-call event

South African teams often process supplier EFTs under time pressure at month-end. Attackers know that. Process beats technology here.

2. What staff should check on every payment-related mail

• Read the full From domain, not the display name (“CEO”, “Accounts payable”)
• Hover links before clicking; compare hostnames to known supplier sites
• Prefer a known contact path (saved number, prior invoice letterhead) over the thread
• Report near-misses so patterns (same lookalike, same pretext) get shared

3. Lookalike domain monitoring

Watch for newly registered domains similar to your brand:

• commercial brand-protection or domain-watch services for high-value brands
• periodic manual checks for high-risk names (typos, -sa, .com vs .co.za)
• abuse reports to registrars/hosting when phishing kits are clear

Honest product note: DMARC Shield monitors your SPF, DKIM, DMARC, and related DNS so exact-domain spoofing and sender drift stay under control. It is not a full lookalike-registration radar. Pair domain authentication monitoring with brand/domain-watch tools (or manual checks) if cousin domains are a top risk.

4. Defensive registration (selective)

You cannot register the entire internet. Prioritise:

• common typos of your primary domain (yourc0mpany, missing letters)
• .com / .co.za swaps if you are known on one
• hyphen variants used in phishing kits for your sector
• pay- / secure- prefixes only if they are common in attacks against you

Document what you own, what you deliberately skip, and who renews the defensive set.

5. What DMARC does vs does not do for lookalikes

Control	Stops exact-domain forgery?	Stops lookalike domains?
DMARC p=none (monitor)	No (reports only)	No
DMARC p=quarantine / p=reject	Yes, at cooperating receivers	No
SPF/DKIM on your domain alone	Helps your mail authenticity	No
Payment dual-control	Indirect	Yes (stops loss)
Domain/brand monitoring	No	Yes (detection)
Defensive registration	No	Partial (reduces inventory for attackers)

Enable and enforce DMARC on the real domain so attackers cannot freely forge @yourcompany.co.za. Then treat lookalikes as a separate programme. Staying on permanent p=none “because of lookalikes” solves neither problem.

For the technical path to enforcement, use the DMARC setup guide and the none → reject operations path.

Attack A: domain spoofing (exact domain)

The attacker sends mail that claims to be from:

From: finance@yourcompany.co.za

without controlling your real mail system. The visible domain is yours.

Primary technical defence: SPF + DKIM + DMARC at enforcement (p=quarantine / p=reject) so major receivers refuse or junk unauthenticated use of your domain.

Without DMARC enforcement, many receivers have no standardised instruction to reject that forgery. Check public posture anytime with free tools.

Attack B: lookalike / cousin domain names

The attacker registers something close enough that busy humans misread it:

• yourc0mpany.co.za (zero for “o”)
• yourcompany-sa.com instead of .co.za
• yourcornpony.co.za
• pay-yourcompany.co.za
• extra or missing hyphens, different TLDs, punycode lookalikes

The message may authenticate correctly for the attacker’s domain. DMARC on your domain does not apply to theirs. This is lookalike domain name spoofing in the social sense: the brand is mimicked; the authenticated domain is not yours.

Primary defences: the five-layer programme above — process, habits, monitoring, selective registration — not “stronger DMARC on the real domain alone.”

Attack C: mailbox compromise (briefly)

A real user account is phished. Mail sends from the real domain with valid authentication. DMARC passes.

Primary defences: MFA, conditional access, anomaly detection, and process controls (out-of-band payment verification). DMARC still matters for everything else, but it will not catch a logged-in attacker.

A quick decision table

What you see	Likely class	DMARC on your domain helps?
Exact @yourcompany.co.za with auth fail	Spoofing	Yes — especially at reject
Exact domain, auth pass, unusual behaviour	Compromise or internal misuse	Indirect only
Almost-right domain, auth pass for that domain	Lookalike	No (needs other controls)
Display name “CEO” but random free mail	Social engineering	Process / awareness

Why attackers prefer lookalikes after you enforce DMARC

As more brands reach p=reject, pure spoofing of the exact domain gets harder in major inboxes. Attackers adapt:

1. Register cheap lookalike domain names
2. Stand up simple webmail or ESP on that domain
3. Authenticate their domain properly
4. Rely on human haste during payment runs

Your DMARC success can shift fraud toward lookalikes. That is progress, not failure — but only if you also harden process and watch cousin domains.

What to do in the first hour of a suspected lookalike fraud

1. Stop the payment if it is not settled.
2. Capture the full From domain and message headers.
3. Confirm whether the domain is yours, a lookalike, or a freeweb address.
4. Warn finance and leadership on a non-email channel if the pretext is still active.
5. Notify the real supplier or customer using known contact details.
6. If funds moved, contact the bank immediately — speed matters more than perfect documentation.
7. Open an internal incident note: domain used, amount, who was targeted, what process failed.

For a broader 30-minute sequence covering exact-domain impersonation too, see the BEC response playbook.

POPIA and customer trust (South Africa)

Lookalike phishing often aims at payment diversion or credential theft. If personal information is exposed, you may have POPIA obligations depending on the facts. Even when POPIA is not triggered, customers remember whether you communicated clearly and fixed the process.

Do not claim “we are DMARC compliant therefore phishing is impossible.” Be accurate: we authenticate our domain; we also train and control payments against lookalikes.

How to talk about this without scaring the board uselessly

Useful framing:

• “DMARC enforcement stops forgeries of our real domain at participating receivers.”
• “Lookalike domains are a separate risk managed with payment controls and monitoring.”
• “Mailbox compromise requires identity security, not only DNS.”

Useless framing:

• “We bought a tool, so email fraud is solved.”
• “We cannot enforce DMARC because of lookalikes.” (Those problems are not solved by staying on p=none.)

Checklist for the quarter

• Apex and important sending domains have DMARC; plan to reach reject (setup guide, enforcement path)
• Finance has out-of-band verification for banking changes
• Staff know how to read the full From domain (lookalike domain names)
• Lookalike domain monitoring or scheduled manual review for top brand strings
• Top 5–10 defensive domains considered or registered
• Incident playbook distinguishes spoof vs lookalike vs compromise
• Aggregate reports reviewed so new exact-domain sources do not surprise you

What to do about lookalike domains

When people ask what to do about lookalike domains, the answer is a programme, not a single product:

1. Verify payments out of band before any banking change lands.
2. Train staff to read the full From domain (lookalike domain names hide in haste).
3. Run lookalike domain monitoring (or a scheduled manual review of new registrations near your brand).
4. Register only high-value defensive domains — not every typo on the internet.
5. Enforce DMARC on domains you own so exact-domain spoofing stops competing with lookalike noise.

That stack is how to stop lookalike domain attacks in practice. DMARC is layer five for your domains; it does not police someone else’s registered lookalike.

Lookalike domains FAQ

What are lookalike domain names?

Lookalike domain names (also called cousin domains) are registrations that look like your brand — swapped letters, extra hyphens, alternate TLDs, or homoglyphs. Mail from those domains can pass SPF/DKIM/DMARC for the attacker domain while still fooling a human who only sees the display name.

How do you stop lookalike domain attacks?

There is no single DNS kill-switch. Stack process controls, human verification, lookalike domain monitoring, selective defensive registration, and DMARC enforcement on your domains so exact-domain spoofing is no longer the easy path.

Does lookalike domain monitoring replace DMARC?

No. Lookalike domain monitoring watches registrations near your brand. DMARC protects forgeries of domains you control. You need both — plus payment discipline — or fraud simply moves to the channel you left open.

Related reading

• How to set up DMARC — publish and raise policy safely
• Safe path from p=none to p=reject — operations journey
• Business Email Compromise response playbook — first-hour incident steps
• DMARC explained for South African businesses — broader local context
• Free domain authentication checks

Bottom line

DMARC is mandatory hygiene against exact-domain spoofing. It is not a complete anti-fraud programme.

Lookalike domain names need human process, selective brand defence, and monitoring of new registrations. Compromise needs identity security. Treat all three as a stack.

If you want a clear read on whether your real domains are publishing usable SPF, DKIM, and DMARC today, start at free tools. For ongoing report visibility and DNS drift on domains you own, Shield Monitor is built for weekly review — not an overflowing report mailbox. Pair that with payment discipline — or the next fraudulent EFT will simply arrive from a domain that is one letter wrong.