07 Oct 20265 minutes read
SendmarcScam Email Addresses: Detection Signals and Controls for Each Type
Scam email addresses overview:
- p=reject blocks scam email addresses that spoof your exact domain
- Lookalike domains pass authentication because attackers publish their own records
- Compromised email accounts pass authentication because messages leave your infrastructure
- Each type of scam email address needs its own control
Some scam email addresses fail authentication and still reach the inbox because the spoofed domain has no DMARC enforcement. Others pass SPF, DKIM, and DMARC because the attacker controls a lookalike domain or a compromised email account. In both cases, the message reaches the recipient looking legitimate.
Scam email addresses that use your exact domain only reach inboxes when DMARC enforcement is missing. Check your domain’s enforcement status with Sendmarc’s DMARC record checker to confirm whether attackers can send as your domain today.
Where DMARC Stops Scam Email Addresses and Where It Doesn't
SPF, DKIM, and DMARC confirm that a message is authorized to use the domain in its "From" header. A p=reject policy tells receiving servers to reject messages that claim your exact domain but fail DMARC. That policy blocks exact-domain spoofing.
Authentication doesn't assess whether a domain owner is trustworthy. An attacker who registers a lookalike domain can publish SPF, DKIM, and DMARC records for it, so email from that domain passes. A compromised email account passes because the message leaves your authorized infrastructure.
Three Types of Scam Email Addresses and How to Detect Them
Scam email addresses fall into three types.
1. Spoofed addresses on your own domain
The attacker uses your exact domain and sends from infrastructure you don’t control. No domain registration or account access is required. The message fails SPF and DKIM alignment.
Your DMARC policy decides what happens next. At p=none, receiving servers take no action on failing mail. At p=reject, they’re instructed to reject it.
Subdomains follow the same logic. Without an explicit sp= tag, subdomains inherit the p= policy. An sp=none tag leaves addresses such as [email protected] open to spoofing, even when the root domain is set to p=reject.
Detection signal: DMARC aggregate reports list every source sending email that claims your domain, with SPF and DKIM results for each. Sources that fail authentication and don’t match a known sender are the signal. These reports only surface threats when someone reviews them on a set schedule.
2. Lookalike domains
Attackers register a lookalike domain that resembles yours. Common patterns include character substitution (rn for m, 0 for o), hyphen insertion (your-company.com), a different top-level domain (yourcompany.io), and added words (yourcompany-payments.com). The attacker then publishes SPF, DKIM, and DMARC records for the new domain. Email from it passes authentication.
Detection signal: Lookalike domains never appear in your DMARC reports because you don’t own them. Detection depends on external monitoring for newly registered domains that resemble your brand.
3. Compromised email accounts
The attacker obtains valid credentials through phishing or a third-party breach. They then sign in to a real account. Messages from a compromised email account leave your own infrastructure, so SPF passes, DKIM signs, and DMARC aligns.
Detection signal: DMARC aggregate reports won’t flag these messages because they authenticate correctly.
The signals are behavioral:
- Sign-ins from unfamiliar locations or devices
- New inbox rules that forward, move, or delete messages
- Unusual send volume or send times
- Recipients replying to messages the account owner didn’t send
Exposed credentials can appear in breach data before an attacker uses them. Monitoring for exposed employee credentials lets teams reset passwords before attackers sign in with them.
Controls for Each Type of Scam Email Address
Each type of scam email address needs a different control. Changes to your own DNS stop exact-domain spoofing. The other types need monitoring and verification processes.
- Exact-domain spoofing: Put every domain and subdomain on a tracked path to p=reject, including domains that don’t send email. Remove
includemechanisms for services you no longer use, since each one authorizes that provider's infrastructure to send for your domain. Remove DKIM keys for retired platforms, since a key stays valid until it’s manually revoked. - Lookalike domains: Run lookalike domain monitoring as a continuous control, since attackers can register new domains at any time. Report confirmed lookalike domains to the registrar.
- Compromised email accounts: Require multifactor authentication (MFA). Monitor for employee credentials exposed in breaches and reset exposed passwords before attackers use them. Revoke active sessions as soon as a compromised email account is suspected.
How Sendmarc Can Help
Detecting every type of scam email address requires visibility across your own domains and beyond them. Stretched security and IT teams managing distributed environments can’t cover that surface through manual DNS audits. Continuous monitoring for exposed credentials and lookalike domains adds further workload.
Sendmarc’s DMARC Management gives unified visibility into SPF, DKIM, and DMARC configurations across root domains, subdomains, and inactive domains. Aggregate report data is parsed automatically, so unauthorized senders claiming your domain surface without manual investigation.
Lookalike Domain Defense monitors newly registered domains that resemble yours and alerts your security team. Breach Detection monitors multiple sources, including the dark web, for exposed employee credentials. Teams can act before a compromised email account is used against customers or partners.
For risk and compliance teams, Sendmarc reporting maps authentication status by domain. That reporting supports board presentations, committee updates, and audit documentation.
Exact-domain spoofing, lookalike domains, and compromised email accounts each need a different control. Explore DMARC Management, Lookalike Domain Defense, and Breach Detection to see how Sendmarc blocks exact domain spoofing, detects domains built to impersonate your brand, and surfaces exposed employee credentials before attackers use them.
