Fake-domain check
Could someone email your customers from a domain that looks like yours? Type your domain to see which lookalikes already exist and which of them can send email.
Why lookalike domains work
People read email fast, on small screens. In many fonts, rn looks like m and a capital I looks like a lowercase l, so a domain one letter off from yours can pass a quick glance. Attackers register these domains to send invoices, payment changes and fake sign-in pages that seem to come from you or from a supplier you trust.
Why mail servers matter
A lookalike with MX records can receive replies, so an attacker can hold a whole conversation with your customer or your accounts team. That's how invoice and payment-change scams work. The US Cybersecurity and Infrastructure Security Agency lists incorrect email addresses and links, such as a misspelled brand name (opens in a new tab), among the main signs of phishing.
What actually protects you
No single step stops lookalikes. What works is layers: owning the closest variants, email filtering that flags new and lookalike sender domains, a rule that payment changes are confirmed by phone, and staff who know the signs. You can practice those signs with our Spot the phish quiz.
Our email security service sets up filtering and DMARC, and security awareness training teaches your team to check the sender before they act.
Questions about fake domains
How does the fake-domain check work?
It builds up to 60 common misspellings of your domain: a different ending like .net or .co, lookalike letters such as rn for m or 1 for l, a missing, doubled or swapped letter, and added hyphens. Then your browser asks public DNS whether each one exists and whether it has mail servers. Nothing is sent to GlobeVM, and the lookalike sites are never visited.
A lookalike exists. Is someone attacking us?
Not necessarily. Many lookalikes belong to unrelated businesses, domain resellers or the real company itself. The ones to watch are those registered recently, those with mail servers, and those you don't recognize. If a lookalike sends your staff or customers email asking for payments or logins, report it to your IT team straight away.
Should we buy every lookalike domain?
No, that's endless. Register the handful closest to your name, such as the same name on .com, .net and .co and the most obvious typo, and point them at your real site. Then rely on email filtering, staff awareness and monitoring for the rest.
Does DMARC stop lookalike domains?
No. DMARC stops people sending email that pretends to come from your exact domain. A lookalike is a different domain with its own records, so your DMARC policy doesn't cover it. You still need DMARC, plus email filtering that flags new and lookalike sender domains.
Want us to fix this?
Get a free IT assessment. We look at your setup and give you a plain-English list of what to fix first. No cost and no obligation.