Which look-alike domains should my firm register itself?

Which names should I register?

Domain owners can sometimes register multiple versions of their domains, such as the ASCII and IDN versions, to improve user experience and prevent potential spoofs. We call these supplementary domains defensive registrations.

Start with the closest copies: your name under the endings clients might guess, your name with one letter doubled or dropped, and your name with a common swap such as rn for m.

CISA lists a free tool, Domain Doppelganger, that looks for domains similar to one you submit.

How should I set them up?

Use HTTP 301 or HTTP 302 redirects, the lookalike warning ignores meta redirects.

It advises redirecting defensive registrations to your main domain with an HTTP 301 or 302 redirect.

The Canadian Centre for Cyber Security advises SPF and DMARC records on domains that send no mail, marking any message from them as illegitimate and to be rejected.

Why not register every variation?

Once DMARC is deployed for all mail domains, you should also deploy SPF and DMARC records to protect domains that do not send mail. These records indicate that any messages received from these domains are illegitimate and should be rejected.

The number of possible variations is very large, so the aim is the handful a client is most likely to type or trust. For the rest, checking new registrations and confirming payment changes by phone does the work.

What are the steps?

Domain Doppelgänger looks for "evil twin" domains that are similar to your submitted domain, helping users to identify potential phishing domains and domain typo squatters and more.

1. List ten to twenty close variations of your name.
2. Check which are free and register the most likely ones.
3. Redirect each one to your main site with a 301 redirect.
4. Publish a null MX record and SPF and DMARC records that reject mail on each.
5. Renew them with your main domain so none of them lapses.