Email spoofing versus a lookalike domain

Exact-domain spoofing

The visible From address uses your real domain without authorization. DMARC can ask receivers to quarantine or reject messages when aligned SPF or DKIM does not support that use. The key evidence is the authenticated domain and alignment result.

Lookalike domains

The sender registers a different domain that resembles the brand through a misspelling, added word or different top-level domain. SPF, DKIM and DMARC may all pass for that domain because the sender controls it. The defence begins with recognition, monitoring and reporting the deceptive use.

Display-name impersonation

The address belongs to an unrelated domain, but the display name shows an executive, supplier or known company. Domain authentication for your own domain cannot block it. Mail rules, identity banners and independent verification for unusual requests help reduce the risk.

Compromised legitimate accounts

A real supplier or employee account may send the message. Authentication can pass and the address can be familiar. Unexpected payment changes, password requests or secrecy still require verification through a separate channel.

Choose the response from the evidence

For exact spoofing, fix domain authentication and gather receiver results. For a lookalike, preserve the registration, mail and destination evidence. For account compromise, secure the account and notify affected contacts from a trusted channel.

Action checklist

1. Decide whether the visible domain is exact, lookalike or unrelated.
2. Check alignment before calling an exact-domain message spoofed.
3. Use independent verification for a familiar but compromised account.