Can someone add a hyphen or a word to my domain name?
Yes.
Last read from the sources at the foot of this page.
What does a hyphen or added word look like?
They must start with a letter, end with a letter or digit, and have as interior characters only letters, digits, and hyphen.
The real name stays whole and something is added around it: yourfirm-law.example, yourfirmgroup.example, yourfirm-invoices.example, or secure-yourfirm.example.
Words like billing, secure, pay or group read like a department or a new service, so the name looks planned rather than copied.
Why is an added word easy to miss?
That is, two names with the same spelling but different case are to be treated as if identical.
The same standard says two names with the same spelling but different case are treated as identical. So capital letters never make a new name, but a hyphen or an extra word always does, and the new name has its own owner.
Because your real name sits inside it, a reader who checks for your name finds it and stops checking.
What can I do about added words?
- Decide which words a client might expect next to your name, such as your line of work or your city.
- Check whether your name with those words, with and without a hyphen, is registered.
- Register the most likely ones yourself and redirect them to your real site.
- Tell clients the one domain your email and invoices come from.
Where does this come from?
- RFC 1035: Domain names, implementation and specificationrfc-editor.orgRead 14 October 2026
See what is open before anyone else does.
We read from outside, find each way in first, and show it with a check anyone can re-run. No access, nothing tested, no obligation.
- We read your firm from outside.
- You see what is open, with the proof for the lead finding.
- If it is worth it, you order.
What happens if you go ahead. More at getleaktrace.com/see-it-first/.
Read the transcript
- 72 hours. One domain. Nothing to install.
- Discover. Every way in, found from outside.
- Validate. Every finding, proven. Dated and checkable by anyone.
- Close. Forged email: one click per step, where we reach your DNS host and you approve it.
- You get the fix for the rest, step by step, and we re-check until it is closed.
- Monitor. On monitoring: email settings, look-alikes and new host names re-checked every hour. Alerts within the hour.
- Every paid assessment is human-verified before release.
- The AI defense layer for businesses. getleaktrace.com/see-it-first/