Once you configure DMARC at enforcement, nobody can send mail claiming to be your exact domain. Attackers respond by registering something adjacent — a hyphen added, a letter swapped, a different suffix — and sending from a domain they legitimately control, which passes its own authentication perfectly.

The usual variations

  • Character substitution: rn for m, l for I, 0 for o.
  • A hyphen inserted or removed.
  • A different top-level domain — .net, .co, or a country suffix.
  • An added word: yourcompany-support, yourcompany-billing, yourcompany-payments.
  • Internationalised characters that render nearly identically in some contexts.

What they are used for

Invoice fraud against your customers, credential phishing aimed at your staff, fake support portals, and occasionally cloned sites collecting orders. The common factor is that the recipient checks the sender, sees something close enough, and proceeds.

Defensive registration

Register the most obvious variants yourself — common misspellings, the main alternative suffixes, and hyphenated forms. This is inexpensive relative to a single successful invoice fraud. You cannot register everything, so cover the handful a rushed reader would not distinguish.

Monitor for new ones

Certificate transparency logs record every certificate issued, so a lookalike setting up a site becomes visible there. Several free and paid services alert on newly registered domains resembling yours. Because most lookalikes are used shortly after registration, early notice is genuinely actionable.

When you find one in use

  • Report to the registrar and hosting provider with evidence of the impersonation.
  • Report the phishing URL to browser safe-browsing services so it gets flagged.
  • Warn your customers and staff directly, naming the domain.
  • Preserve evidence — screenshots, WHOIS, message headers — before it disappears.

Tell customers what to expect

State on your site which exact domain you email from, and that your bank details never change by email. Customers who know what normal looks like are far more likely to notice when something is not, and this costs nothing to publish.