How to Check for Lookalike Domains That Could Impersonate Yours

To check for lookalike domains, generate the near-copies of your domain and look each one up in public DNS. Variants include a missing or swapped letter, rn for m, Cyrillic letters that look Latin, and .co for .com. The lookalike domain checker builds up to 150 of them, checks which are registered and which have mail servers, and lets you download the result. For email, the ones with MX records matter most, because they can send messages that pass a quick glance as yours.

A registered lookalike is not proof of an attack. It is a list of places to look.

What a lookalike domain is

A lookalike domain is a name registered to resemble a real one closely enough to fool a reader: examp1e.com, exmaple.com, example-secure.com, or еxample.com written with a Cyrillic е. Registering such names to catch mistyped visits is typosquatting. Using them in email is a common way to impersonate a company to its customers and staff.

The Unicode variants work because domain names can contain non-Latin letters, encoded as xn-- punycode under IDNA (RFC 5891). Unicode's UTS #39 catalogues characters that look alike, and Chrome shows suspicious mixed-script names as punycode, as its IDN policy explains.

Step 1: enter your domain

Open the lookalike domain checker and type your domain, such as yourbrand.com.

Step 2: let it generate and check the variants

The tool builds nine kinds of variant:

1. a missing letter
2. a doubled letter
3. swapped letters
4. a neighbouring-key slip
5. ASCII look-alikes (0 for o, rn for m, vv for w)
6. Cyrillic look-alikes
7. an added hyphen
8. a different TLD
9. common phishing words such as secure- or -login

This is the same approach open-source tools like dnstwist use. Each variant is looked up for three things: NS records (registered and delegated), A or AAAA records (something answers on the web) and MX records (it can receive mail, and is often set up to send). Nothing is sent to the lookalike domains themselves; it takes a few seconds.

Step 3: start with the ones that have MX records

Order your attention like this:

Result	What it tells you	Priority
Registered, has MX	The domain has mail servers set up	Look first
Registered, resolves on the web	Something is hosted there	Look next
Registered, nothing else	Parked or held	Note it
Not registered	Free to register	Consider registering the likeliest

For anything you don't recognise, check the owner with the WHOIS lookup. Registrant details are often privacy-protected, but the registrar and creation date are usually visible, and a domain created last week with MX records and a name close to yours deserves attention. For many domains at once, see WHOIS lookup for a list of domains.

Step 4: know what DMARC does and doesn't do

DMARC, defined in RFC 7489, protects the exact domain in the From address. With p=reject, mail claiming to be from yourbrand.com that fails authentication is refused. A lookalike is a different domain, which its owner can authenticate perfectly well. DMARC on your domain has no say over it.

So the two jobs go together:

• Enforce DMARC on your own domain so attackers can't use your real name. The DMARC checker shows your current policy, and moving DMARC from none to reject walks through it.
• Watch for lookalikes, especially ones with MX records, and act on the ones that impersonate you.

Step 5: decide what to do about the ones you find

• Register the few most likely to be abused. Usually your name on the main TLDs and the most obvious typos, pointed at your real site. You can't register them all.
• Monitor the rest. Run the check regularly and compare the downloaded CSVs to see what is new.
• Report impersonation. For a lookalike used to pose as you, report phishing to the registrar's abuse contact shown in the WHOIS record and to the hosting provider.
• Use the formal route only when it fits. Where a domain uses your trademark in bad faith, ICANN's Uniform Domain-Name Dispute-Resolution Policy is the process for having it transferred. Get legal advice before claiming someone else's domain is infringing.

What this checker can't do

• It covers up to 150 common variants, not every possible lookalike. Other scripts, two-letter typos and some new TLDs aren't all included.
• Registered says nothing about owner or intent. Many lookalikes are defensive registrations or unrelated businesses.
• DNS shows set-up, not activity. It can't see whether a domain is actually sending email or hosting a phishing page.
• Some TLDs answer every name, which can make an unregistered variant look registered. Check any that surprise you with WHOIS.
• It doesn't alert you to new registrations. You re-run it and compare.

A paid domain-monitoring service typically covers more variants, watches new-registration feeds and helps with takedowns. The checker is the free, on-demand version.

The email side of the same problem

If your customers receive mail from yourbrand.co and it is not you, the damage lands on your reputation. If your own sending domains are new, look at checking a new domain is ready to send email and auditing every domain your company owns. And if the list you mail contains addresses at typo domains of well-known providers, those bounce; the email typo corrector fixes them before you send.

Check your own domain

Enter it in the lookalike domain checker and download the CSV. Then check the addresses you mail on the verify page: the first 100 email checks are free with a Google sign-in, no card, and each address comes back valid, risky or invalid with a reason. For lists and recurring checks see bulk email verification and pricing.