Lookalike Domains: What DMARC Cannot Stop, and What You Can Do Instead

DMARC only protects the exact domain it is published on. It cannot stop a criminal registering yourcornpany.co.za or yourcompany.com, faking a display name from a free webmail account, or sending from a genuinely compromised mailbox. Those attacks need different controls: defensive registrations, monitoring, external email tagging, mailbox security and, above all, payment verification by phone.

What DMARC actually covers

DMARC answers one precise question for a receiving server: did this message, which claims to come from yourcompany.co.za in the visible From header, genuinely come from a system that domain authorised? If the answer is no and you publish p=reject, the message is refused. That is powerful, and it closes the most direct form of impersonation: exact-domain spoofing, where an attacker simply types your domain into the From field. Our guide on how spoofing leads to invoice fraud covers why that matters so much to South African finance teams.

But the protection is literal. DMARC knows nothing about what a domain looks like to a human, who owns a similar domain, or whether the person logged in to a real mailbox is the real person. Being honest about those limits is the difference between a security control and a false sense of security.

Four attacks DMARC does not stop

1. Typosquats and character swaps

An attacker registers a domain that differs by a character or two: yourcornpany.co.za (r and n imitating m), yourcompnay.co.za, your-company.co.za, or a domain using the letter l or the digit 1 in place of an i. On a phone screen, in a hurried inbox, these pass for the real thing. The attacker owns the lookalike, so they can publish valid SPF, DKIM and even DMARC for it. Every check passes, because the mail genuinely comes from the domain it claims.

2. Different top-level domains

Many South African businesses own .co.za but not .com, .africa or .org.za. A message from accounts@yourcompany.com looks entirely plausible to a supplier who has never had reason to note which extension you use.

3. Display-name deception

The cheapest attack of all needs no domain. The attacker creates a free webmail account and sets the display name to “Your Company Accounts” or the managing director’s name. Many mail apps, especially on mobile, show the display name prominently and hide the address. DMARC evaluates the address domain, which belongs to the webmail provider and passes its own checks.

4. Compromised mailboxes

If an attacker phishes a staff member’s password, or a supplier’s, they send from the real mailbox through the real mail platform. SPF, DKIM and DMARC all pass because, technically, nothing is spoofed. This is often the most damaging variant, because the attacker can read real conversations and insert themselves at exactly the moment an invoice is due.

Why DMARC still matters

A reasonable reaction to that table is: if DMARC only stops one of five, why bother? There are three good reasons.

First, exact-domain spoofing is the easiest, most convincing attack, and it is the one your customers and suppliers are least equipped to spot. Their mail app shows your real domain, so nothing looks wrong. Removing it forces attackers onto techniques that leave visible clues: an odd extension, a misspelling, a webmail address behind a display name. Those clues are what training and verification habits can catch.

Second, the major mailbox providers now expect it. Google and Yahoo have required a DMARC record from bulk senders since February 2024, and Microsoft introduced similar requirements for Outlook.com consumer domains in May 2025. The details are in our article on sender requirements.

Third, the reporting side of DMARC gives you visibility you would not otherwise have: which systems send as you, and who is trying to. That evidence informs every other control on this page.

Controls that close the gap

Defensive registrations

Register the obvious variants of your primary domain: the .com if available, common misspellings, and hyphenated forms. You do not need dozens. Focus on the handful an attacker would most plausibly pick. Then lock every one down so it cannot send mail, as described in locking down parked domains: v=spf1 -all, a DMARC record at p=reject and, where appropriate, a null MX.

Lookalike monitoring

You cannot register every variant. Monitoring new domain registrations and certificate transparency logs for names resembling yours gives early warning when someone registers one. Several security vendors and registrars offer this; the useful output is an alert you can act on, usually a takedown request or a warning to your finance team and key suppliers.

External email tagging

Microsoft 365 and Google Workspace can both mark mail from outside the organisation, through a banner or an “External” tag. When a message claiming to be from your managing director carries that tag, it is a strong signal. Pair it with first-contact or impersonation warnings where your platform offers them.

Mailbox security

Compromised mailboxes are a credential problem. Enforce multi-factor authentication on every mailbox, disable legacy authentication protocols, review mailbox forwarding rules regularly (attackers love a silent rule forwarding invoices to an external address), and alert on sign-ins from unexpected countries.

Payment verification

This is the control that defeats every row of the table. No change to banking details is accepted on the strength of an email, however genuine it looks. Phone the supplier on a number from your own records, not from the email, and require a second approver for any change. Our banking details fraud checklist sets this out step by step.

Matching each attack to a control

Notice that payment verification appears more than once. Technical controls reduce how often a fraudulent request reaches someone. A verification process limits what it costs when one does.

A practical plan for a South African SME

1. Get your primary domain to p=reject with every legitimate sender aligned. Start with a free DMARC check to see where you stand.
2. List the domain variants an attacker would most likely use, register the important ones and lock them down.
3. Switch on external tagging and impersonation protection in your mail platform.
4. Confirm MFA is enforced on every mailbox, including shared and service accounts where supported.
5. Write a one-page payment verification policy and have finance sign it.
6. Tell your top suppliers and customers, in writing, which domain you send from and that you will never change banking details by email alone.

When you find a lookalike in use

Speed matters more than perfection. Check whether the lookalike has MX records or a website, which tells you whether it is set up to send or receive mail. Warn your finance team and the suppliers or customers most likely to be targeted, naming the exact domain. Report the domain to the registrar and, for .co.za names, for .co.za names, consider a complaint under the .za Alternate Dispute Resolution Regulations (ZADNA) if the registrar does not act if the registrar does not act. Preserve any emails received from it, with full headers, in case they are needed by your bank or the police. Finally, review whether the attacker had information they should not have had, such as a real invoice number, because that points to a compromised mailbox somewhere in the chain rather than a simple guess.

None of these steps is expensive. Together they cover every row of the table, which no single product does.

How MailMarq helps

MailMarq handles the DMARC part properly: we take your primary domain from monitoring to p=reject with evidence at every step, lock down your parked and defensive domains, and keep watching for new senders all year. We will also tell you plainly where DMARC stops and other controls must take over. Get in touch for a free assessment.

Frequently asked questions

MailMarq
MailMarq is a managed DMARC service run from Johannesburg. Our team has built and managed business websites, hosting and email infrastructure for South African companies since 2016, and writes these guides from work on real domains.