Lookalike Domain Detector
A domain one character away from yours can pass a quick glance in an inbox. Attackers register these domains for phishing, invoice fraud, or credential theft, and the DMARC policy on your own domain can't block them.
Sendmarc's lookalike domain detector finds domains that resemble yours, checks what each one can do, and ranks them by risk.
Enter your domain to find registered lookalikes, exposed infrastructure, and high-risk names.
What Is a Lookalike Domain Detector?
A lookalike domain is a separate domain built to resemble a legitimate domain or brand. It may use a misspelling, a substituted character, an extra word, or a different top-level domain (TLD).
A lookalike domain detector finds these registrations and shows which ones need attention.
The detector also creates spelling and character variations of the domain you enter and searches public certificate transparency logs for brand-related hostnames that a permutation list can’t generate, including combination domains and brand-as-subdomain patterns.
IT administrators use the results to review registrations near their domain portfolio. Security teams use them to prioritize phishing and impersonation investigations. Brand, fraud, and legal teams can use the same evidence when deciding whether a domain needs defensive registration, monitoring, or takedown action.
Why Lookalike Domains Matter
A near-match passes a glance
DMARC can’t reach another domain
Manual checking doesn’t scale
Support for risk and audit programs
What Sendmarc’s Lookalike Domain Detector
Shows You
Generated variations
Spelling, keyboard, character, word, and TLD permutations of the domain you enter.
Highest-risk names first
Results are ranked by the signals above rather than alphabetically, so live email, weak DMARC policies, and recent certificate activity surface before dormant registrations.
Scan results
Live mail · No DMARC
New cert
Parked
Domain and display form
The hostname as registered or observed in certificate logs, with Unicode and punycode forms shown where relevant.
Domain and display form
Unicode
Punycode
Certificate log hostname
Discovery source
Whether the detector generated the name or found it in public certificate transparency records.
Discovery source
Lookalike technique
The variation type, such as a typo, homoglyph, combination word, TLD change, or brand-as-subdomain pattern.
Lookalike technique
Email capability and DMARC posture
Whether the domain publishes MX records and whether its DMARC policy is missing, none, quarantine, or reject. Registrar-default mail on parked domains is separated from active mail capability.
Email capability and DMARC posture
aspmx.l.google.com
DMARC can’t reach another domain
Policy on sendmarc.com does not apply
Website and registration evidence
Whether the name resolves to an IP address, has delegated nameservers, or appears only in historical certificate data.
Website and registration evidence
203.0.113.24
ns1.example-dns.net
No live website
Certificate history
The earliest public certificate date from certificate transparency logs, with a "New" label for recently observed names.
Certificate history
First certificate: 6 Oct 2026
First certificate: 14 Mar 2024
First certificate: 2 Nov 2022
Risk level
Critical, high, medium, or low based on mail capability, DMARC posture, certificate use, lookalike technique, domain age, parking, and infrastructure overlap.
Risk level
Live mail · No DMARC · New cert
Live mail · Homoglyph
New cert
Parked
Ownership and campaign context
Labels such as Likely yours, parked, same mail provider, copied SPF, shared infrastructure, and coordinated registration-window indicators, shown when the evidence supports them.
Ownership and campaign context
Same mail provider · Shared infrastructure
Defensive registration candidates
High-risk generated variants that don’t resolve, with availability checked through Registration Data Access Protocol (RDAP).
Defensive registration candidates
How to Use the Lookalike Domain Detector
- Enter your
domain. Type the domain only, without https or a page path. - Wait for
both scans. Generated names appear first. Certificate results join the same table. - Review critical and
high-risk first. Start with live mail, weak DMARC policies, new certificates, or a close visual match. - Confirm
Likely yours. Hide those rows to focus on potential threats, or keep them visible to confirm the label. - Choose a
next step. Investigate live names, register available variants, or start a takedown request.
Lookalike Domain Detector FAQs
What is a lookalike domain?
A lookalike domain is a separate domain designed to resemble a legitimate domain, business, or brand. It may contain a typo, a substituted character, an extra word, a different TLD, or a misleading subdomain.
How does the lookalike domain detector find domains?
A lookalike domain detector finds domains in two ways. It generates spelling, character, word, and TLD variations of your domain, and it searches public certificate transparency logs for brand-related hostnames.
What is certificate transparency in a lookalike domain scan?
Certificate transparency is a public record of issued TLS certificates. In a lookalike domain scan, certificate transparency logs reveal hostnames using your brand name, including combination domains and brand-as-subdomain patterns that a permutation list wouldn't generate.
Does DMARC stop lookalike domains?
No. DMARC doesn't stop lookalike domains because it only applies to the domains you own. An attacker who registers a lookalike domain controls that domain's authentication records, so lookalike domains require separate monitoring.
What do the detector’s risk levels mean?
The detector’s risk levels rank technical evidence from critical to low. Live mail, missing or weak DMARC policy, close visual similarity, recent certificates, copied infrastructure, and coordinated registrations can raise risk, while parking or likely common ownership can lower it.
Why does a result say Likely yours?
A result says Likely yours when the lookalike domain uses the same nameserver infrastructure as the domain that was scanned. This is an ownership clue, not proof, so the company should confirm the domain before excluding it from review.
Can a lookalike domain detector prove that a domain is malicious?
A lookalike domain detector can’t prove that a domain is malicious from registration and infrastructure signals alone. The results identify domains that warrant review.
How often should I scan for lookalike domains?
Scan for lookalike domains regularly and after events that change your exposure, such as a rebrand, acquisition, new market launch, or reported impersonation attempt. A single lookalike domain scan only reflects registrations at that moment.