# Lookalike Domain Attacks: How One-Character Fakes Get Past DMARC and How to Defend Against Them

> Lookalike domain attacks imitate your address with a one-character change and still pass DMARC. Learn the 7 types, how to detect them and 7 defence steps.

Source: https://digitalbridge.com.tr/en/blog/lookalike-domain-attacks.html
Publisher: Digital Bridge Teknoloji (https://digitalbridge.com.tr)
Topic: Business Email & Documents
Published: 2026-10-01 · Updated: 2026-10-23

A lookalike domain attack is when an attacker registers a domain that differs from yours, or a partner's, by a single letter, digit, hyphen or extension, such as `exarnplefirm.com` for `examplefirm.com`, and sends email from it. Because the attacker genuinely owns that domain, the message can pass SPF, DKIM and [DMARC](https://digitalbridge.com.tr/en/glossary.html#dmarc); only a domain-similarity check will catch it.

## Key takeaways

- A lookalike domain attack sends email from a newly registered domain that imitates a real one by a letter, digit, hyphen or extension.
- Because the attacker owns the domain, the email can pass SPF, DKIM and DMARC; DMARC only prevents exact spoofing.
- Homoglyph (IDN) addresses using Cyrillic letters look identical to the real domain on screen; only automated checks catch the difference.
- EasyDMARC's 2026 report found that only about 23% of 1.8 million scanned domains enforce DMARC at quarantine or reject.
- An effective defence has three layers: enforce DMARC on your own domain, measure similarity in inbound mail automatically, and confirm payment requests by phone.

The hardest lookalike domains to spot are homoglyph addresses written with Cyrillic letters that look identical on screen. A sound defence has three parts: protect your own domain, detect similarity in inbound mail automatically, and confirm critical requests through an independent channel.

## Why do lookalike domain attacks work so well?

When someone opens an email, their eye does not read the address letter by letter; it recognises a familiar shape. Telling `exampleholding.com` from `exampleho1ding.com` on a busy day is hard, and on mobile devices the address is often hidden altogether, with only the display name shown.

Attackers register these domains cheaply and for a specific target. They are usually short-lived: used for a few weeks, then dropped, finishing the job before they land on blocklists. Typical scenarios include:

- **Supplier impersonation:** an email to accounts from an address resembling a real supplier, announcing "our new bank account". We cover the freight-sector version in [logistics email fraud](https://digitalbridge.com.tr/en/blog/logistics-email-fraud.html).
- **Executive impersonation:** an "urgent and confidential" payment request to finance from an address resembling your own domain; we cover this scenario in detail in [what is CEO fraud](https://digitalbridge.com.tr/en/blog/what-is-ceo-fraud.html).
- **Customer impersonation:** order or quote correspondence to sales from a domain imitating a customer's. During a tender the target is the bid file itself; see our [tender email security controls](https://digitalbridge.com.tr/en/blog/tender-email-security.html).
- **Fake login pages:** a credential-harvesting page on a domain that resembles your company portal. Limiting the damage of a stolen password with multi-factor authentication is covered in [business password security](https://digitalbridge.com.tr/en/blog/business-password-security.html).

## The scale of the problem: phishing, BEC and DMARC data (2025–2026)

Lookalike domains are the infrastructure behind phishing and payment diversion fraud, and the scale of those attacks shows why this matters.

> According to [Türkiye's Ministry of Transport and Infrastructure](https://www.uab.gov.tr/haberler/bir-ayda-1-milyar-98-milyon-721-bin-zararli-erisim-istegi-engellendi), USOM, Türkiye's National Cyber Incident Response Centre, blocked access to 991 domains used for phishing and prevented 5,869 phishing attacks in January 2025 alone.

- The Anti-Phishing Working Group's (APWG) [Phishing Activity Trends Report for Q2 2026](https://docs.apwg.org/reports/apwg_trends_report_q2_2026.pdf) recorded 1,069,681 phishing attacks in the quarter, up 10.1% on the previous one.
- The FBI Internet Crime Complaint Center's (IC3) [2025 Internet Crime Report](https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf) shows 24,768 [business email compromise (BEC)](https://digitalbridge.com.tr/en/glossary.html#bec) complaints in the US in 2025, with total reported losses of $3.05 billion. Much of this fraud relies on addresses that imitate a trusted contact.

As of 2026, protection of organisations' own domains is patchier than many assume. [EasyDMARC's 2026 DMARC Adoption Report](https://easydmarc.com/blog/easydmarc-releases-2026-dmarc-adoption-report/), which scanned 1.8 million domains, found that 52.1% have a DMARC record but only 411,935 domains (about 23%) enforce a quarantine or reject policy. Many organisations leave the door open even to exact-match spoofing of their own address.

## What types of lookalike domain are there?

| Type | Example (real: `examplefirm.com`) | Why it works |
|---|---|---|
| Letter substitution | `exarnplefirm.com` ("rn" for "m") | At small font sizes "rn" looks like "m" |
| Digit–letter swap | `examp1efirm.com` | "1" and "l", "0" and "o" are easily confused |
| Added or missing letter | `examplefirmm.com`, `examplefrm.com` | The eye fills in the gap when reading quickly |
| Hyphen or extra word | `example-firm.com`, `examplefirm-uk.com` | Looks corporate and "official" |
| Different extension | `examplefirm.co`, `examplefirm.com.tr` | Few people check the extension |
| Subdomain trick | `examplefirm.com.verify-account.net` | The start looks right, which builds trust |
| Homoglyph (IDN) | Cyrillic "а" instead of Latin "a" | Identical on screen; underneath it is a different name beginning `xn--` |

Homoglyph attacks deserve particular attention. Internationalised domain names (IDNs) allow letters from other alphabets in domain names. Characters that look identical but have different codes cannot be told apart by the human eye; only software can see the difference.

## How to prevent lookalike domain attacks: 7 steps

1. **Move DMARC on your own domain to enforcement.** Once SPF (Sender Policy Framework) and DKIM (DomainKeys Identified Mail) are set up correctly, monitor DMARC (Domain-based Message Authentication, Reporting and Conformance) with `p=none`, then move to `p=quarantine` and `p=reject`. This stops exact spoofing of your address. See [SPF, DKIM and DMARC explained](https://digitalbridge.com.tr/en/blog/spf-dkim-dmarc-explained.html) for detail. How to spot spoofing attempts in the reports you receive during the `p=none` phase is covered in [how to read DMARC reports](https://digitalbridge.com.tr/en/blog/how-to-read-dmarc-reports.html).
2. **Register the most likely variants defensively.** Hyphenated spellings, common extensions and the most obvious typos. You cannot register every variant, but closing the easiest ones raises the attacker's effort.
3. **Keep a list of key contacts.** Know the real domains of the suppliers you pay regularly and the customers you correspond with; this list is the reference for any similarity check.
4. **Check inbound mail for similarity automatically.** Your email platform should ask of every message whether the sender's domain imitates yours or a known contact's, and whether it contains international characters. It is one of the criteria to test when you [choose a business email service](https://digitalbridge.com.tr/en/blog/business-email-how-to-choose.html).
5. **Make external senders visible.** Clearly marking mail from outside the organisation makes it easier to notice an external message using a "Managing Director" display name.
6. **Confirm critical requests through an independent channel.** Bank-detail changes, urgent payments and password requests should never be accepted by email alone; call the contact on the number you already hold. We cover this scenario in our guide to [bank detail change email fraud](https://digitalbridge.com.tr/en/blog/bank-detail-change-email-fraud.html).
7. **Show your team real examples.** The table of lookalike domain types is enough material for a short awareness session. For the wider set of warning signs, see [how to spot phishing emails](https://digitalbridge.com.tr/en/blog/how-to-spot-phishing-emails.html).

### What should you do when you notice a suspicious domain?

Forward a message from a lookalike domain to IT before deleting it; others in the organisation may have received mail from the same domain. If it imitates one of your suppliers, tell the supplier too, since their other customers may be targeted. If correspondence containing personal data was sent to that address, assess whether it counts as a personal data breach under KVKK (Türkiye's Law No. 6698 on the Protection of Personal Data, broadly comparable to GDPR); our [data protection compliance](https://digitalbridge.com.tr/en/consultancy/data-protection-compliance.html) team can help with that assessment. If notification is required, the deadline and steps are set out in [the KVKK 72-hour breach rule](https://digitalbridge.com.tr/en/blog/data-breach-72-hours-kvkk.html).

To set up your own domain's authentication records correctly from the start, follow the eight steps in [how to set up email with your own domain](https://digitalbridge.com.tr/en/blog/set-up-email-with-your-domain.html).

## How we approach this at Digital Bridge

In our [cyber security consultancy](https://digitalbridge.com.tr/en/consultancy/cyber-security.html) we handle lookalike-domain risk with a concrete inventory:

- **Domain inventory:** we list every domain your organisation owns, its SPF/DKIM/DMARC status and the current DMARC policy level, then plan the move to enforcement in stages.
- **Variant analysis:** we identify the variants of your domain that are easiest to imitate and help you decide which are worth registering defensively.
- **Contact list and process:** we document the domains of the suppliers you pay and write down the procedure for confirming bank-detail changes.
- **Email platform:** if your current system does not detect lookalike domains, we plan a move to one that does so on every message through our [cloud migration and infrastructure consultancy](https://digitalbridge.com.tr/en/consultancy/cloud-migration-infrastructure-consultancy.html).

## How SmartMail catches lookalike domains

**[SmartMail](https://digitalbridge.com.tr/en/smart360/smartmail.html)**, the business email product in Digital Bridge's own [Smart360](https://digitalbridge.com.tr/en/smart360.html) family, puts every inbound message through three groups of checks: identity, structure and content. Two of the structural checks target this attack directly: **lookalike domain** and **international character** detection. They sit alongside display-name and brand impersonation, Reply-To and link mismatches, SPF/DKIM/DMARC and PTR results that SmartMail calculates itself, and an AI assessment of the message text as a whole.

A concrete scenario: your purchasing team receives an email from your logistics provider's domain, except that a Latin "a" has been replaced with a Cyrillic "а". It asks for the attached proforma invoice to be paid today. The address looks identical and passes DMARC. SmartMail flags the message with **a written report stating the reasons**: the domain contains international characters and imitates a known contact's domain, and the content carries a payment request.

If the message falls below the trust threshold your organisation sets, it is quarantined. The threshold is set by your company administrator, and before a new threshold is saved SmartMail lists the messages it would affect. Quarantined mail is not deleted; it waits with its reasons.

One important detail: in SmartMail, authentication and lookalike-domain checks are run by software and keep working even if the monthly AI allowance is used up. Only AI operations pause until the next period, so this protection does not depend on the AI quota.

There is also a layer against the second stage of a lookalike domain attack. Even if a message gets through, replies such as a payment confirmation sent on behalf of the organisation can be routed through SmartMail's **send approval**, which puts them before one or more approvers; every step is recorded with date and time. In shared mailboxes, team notes and "flag for attention" let staff point a colleague to a suspicious message. Our article on [email approval workflows](https://digitalbridge.com.tr/en/blog/email-approval-workflow.html) explains how to set this up.

## Next step

Start by seeing where your domains stand today: what level DMARC is at, which variants are exposed, and whether your inbound email platform measures similarity at all. Our [cyber security team](https://digitalbridge.com.tr/en/consultancy/cyber-security.html) can run that assessment; you can also explore SmartMail's security analysis on the [SmartMail product page](https://digitalbridge.com.tr/en/smart360/smartmail.html) or [contact us](https://digitalbridge.com.tr/en/contact.html) for a live demonstration. To buy SmartMail, use the [Smart360 Buy Now page](https://smart360.com.tr/satin-al?urun=smartmail). The other fraud types that rely on domain impersonation are gathered in our [Business Email & Documents guide](https://digitalbridge.com.tr/en/blog/topic/kurumsal-eposta.html).

## Frequently Asked Questions

### What is a lookalike domain attack?

It is when an attacker registers a domain that resembles yours or a partner's, differing by a letter, digit, hyphen or extension, and sends email from it. The goal is for the recipient to trust the familiar-looking address and act on a payment, password or document request. Because the attacker genuinely owns the domain, these messages often pass SPF, DKIM and DMARC checks.

### Does DMARC stop lookalike domain attacks?

Not on its own. DMARC only prevents exact spoofing of your own domain. If the attacker writes from a lookalike domain they registered, that domain's SPF, DKIM and DMARC records are valid, so inbound mail also needs a domain-similarity check. Even so, moving DMARC on your own domain to enforcement is still necessary to prevent exact spoofing.

### How can you detect a homoglyph (IDN) attack?

Letters from different alphabets that look identical cannot be distinguished by eye. Some email clients display such addresses in punycode, beginning xn--, but the most reliable approach is an email platform that detects international characters automatically. Even when an address looks familiar, confirm any payment or password request through an independent channel.

### Should we register every variant of our domain?

Registering every variant is neither possible nor economical. A more realistic approach is to register a handful of the easiest imitations defensively and rely on automatic similarity checks in inbound mail for the rest. Prioritise hyphenated spellings, common extensions and the most obvious typos, as these are the easiest to imitate.

### What should you do with a suspicious email from a lookalike domain?

Forward it to IT before deleting it, because others in the organisation may have received mail from the same domain. If the domain imitates one of your suppliers, tell the supplier as well, since the same attack may be aimed at their other customers. If correspondence containing personal data went to that address, also assess whether it counts as a personal data breach under KVKK.

### Will SmartMail notice a domain imitating one of our suppliers?

SmartMail's lookalike-domain and international-character signals assess on every message whether the sender's domain has been made to resemble a familiar address, and the result is shown in writing with its reasons. Against supplier impersonation, we recommend combining this with a process that confirms bank-detail changes by phone on a number you already hold.

### Does SmartMail's lookalike domain check stop if the AI allowance runs out?

No, it does not. In SmartMail, SPF, DKIM, DMARC and lookalike-domain checks are run by software and are independent of AI, so they keep working even when the monthly AI allowance is used up. Only AI operations, such as the AI assessment of the message text as a whole, pause until the next period.