Does DMARC protect my firm from look-alike domains?

What does DMARC cover?

DMARC does not attempt to solve all problems with spoofed or otherwise fraudulent email. In particular, it does not address the use of visually similar domain names ("cousin domains")

RFC 7489 describes DMARC as a way for a mail-originating organization to express domain-level policies for validating and handling its mail.

The policy is published on your domain and applies to mail that uses your domain in the From address. It says nothing about any other domain.

Why does a look-alike get past DMARC?

Therefore, a threat actor can increase the likelihood that malicious emails are delivered by implementing SPF and DKIM for a domain under their control, while presenting a different and more trustworthy domain in the message's From field to trick the recipient.

A look-alike is a different domain with its own owner. Its owner can publish their own settings, so mail from it can pass every check.

The Canadian Centre for Cyber Security notes that a threat actor can set up SPF and DKIM for a domain under their control while presenting a more trustworthy domain in the From field.

What covers the gap?

Domain-based Message Authentication, Reporting, and Conformance (DMARC) is a scalable mechanism by which a mail-originating organization can express domain-level policies and preferences for message validation, disposition, and reporting

1. Keep DMARC on your own domain at a policy that rejects or quarantines failing mail.
2. Register the closest look-alikes of your name yourself, so nobody else can.
3. Check new registrations of names close to yours and look at whether they have mail set up.
4. Confirm any change to payment details by phone, on a number already on file.