Business
Business Security · Overview
Individual
Personal Protection · Overview Personal Credential Briefing
Programs
Perimeter · Households Wealth Firms Sports & Entertainment Agencies Reputation Threat Intelligence Wealth Manager Program Business Broker Program Partners
Intelligence
Research Library Threat Intelligence Global Breach Map Recent Breach Disclosures
Company
How It Works About Contact
Domain Impersonation

Lookalike domains and forgeable email in your firm's name

Two ways a stranger sends email that looks like it came from you: register a domain one letter off yours, or send from your exact domain because your mail rules allow it. We read both from public registration and DNS records, and write the fix step for your IT provider.

Request your firm's brief How we read it
Lookalike Domains
Registrations one character off your domain, read from public records
Lookalike Characters
Visually similar characters (rn for m, l for 1) in registered domains
Forgeable Email
Whether your mail rules (SPF, DKIM, DMARC) let a stranger send as you
Daily Re-check
The same records re-read daily under monitoring; a named contact is told of changes
Capabilities

What We Read

Two public records, read the way anyone could read them: the domains registered near yours, and the DNS records that say who may send email in your name.

Lookalike Domains
Registered domains with character swaps, additions, and omissions that mimic your domain name, read from public DNS records.
Lookalike Characters
Visually similar characters, such as rn for m or l for 1, used to make a registered domain read as yours.
Forgeable Email
SPF says which servers may send as you. DKIM signs what they send. DMARC tells receivers what to do when neither matches. We read all three and say in plain words what a stranger can do.
Daily Re-check Under Monitoring
The same lookalike list and the same mail rules are re-read daily. When a record changes or a new lookalike appears, a named contact at your firm is told.
In Practice

What a Finding Looks Like

Sample findings, as they appear in Technical Evidence and Findings. Values are illustrative and labelled Sample.

Lookalike Domains

Registered domains near yours, read from public registration and DNS records.

Forgeable Email

Your SPF, DKIM and DMARC records, and what they let a stranger do, in plain words.

The Registrar Check

The one-line check anyone can run to see whether a lookalike is registered, so you can confirm the finding yourself.

The Fix Step

What your IT provider does: publish or tighten the DMARC record, and warn staff and clients that the lookalike exists.

Lookalike DomainsSample
acmec0rp.comRegistered
acrnecorp.comRegistered
acmecorp.netRegistered
acme-corp.comRegistered
acmecorp.orgNot registered
4
Lookalikes registered in this sample
Public
Read from registration and DNS records
Dated
Every finding carries its date
Sample
Illustrative values
Forgeable EmailSample
SPF: lists your mail provider's serversPresent
DKIM: signature published for your mail providerPresent
DMARC: p=noneNot enforced
In plain words: a stranger can send as you and it will be deliveredFinding
The fix step for your IT providerIncluded
Daily
Re-read under monitoring
Named
A contact at your firm is told when a record changes
The Registrar CheckSample
Look up the lookalike at any public registration lookupAnyone can run
Read the registration date and the registrarPublic record
Compare it with your own domain's recordPublic record
Confirm the finding yourself before acting on itYour call
One
Line check anyone can run
Public
Registration records
Dated
Every finding carries its date
Sample
Illustrative values
The Fix StepSample
Publish a DMARC record and move it to quarantine, then rejectIT provider
Confirm SPF lists only the servers that send for youIT provider
Tell staff and clients that the lookalike domain existsOwner
The check that proves the fix is doneIncluded
Yours
Performed by your IT provider, not by LeakTrace
Daily
Re-checked under monitoring
Process

How we read it

Five steps, from the first read to the daily re-check.

1
2
3
4
5
Step 01
We Read Your Firm From Outside

We read five things: whether email in your firm's name can be forged (SPF, DKIM, DMARC), which staff addresses appear in monitored breach databases, lookalike domains, what your own website and mail setup advertise, and what AI assistants say about your firm.

Coverage

What You Receive

Lookalike registrations and your mail rules, read at audit and re-read daily under monitoring.

Public
Read from registration and DNS records
Daily
Re-check under monitoring
72h
Audit delivered inside 72 hours of confirmation
Industries

Who This Is For

Firms whose clients act on an email that looks like it came from the firm.

Law Firms
Payment instructions move by email. A lookalike domain, or mail forged from your exact domain, is what a redirected payment rests on.
Accounting Practices
Filings and client banking details move by email in season. Whether your domain can be forged decides whether a client can tell your message from a stranger's.
Dental and Medical Practices
Patients act on reminders and invoices sent in the practice's name. Forgeable email lets a stranger send in that name too.

Request your firm's brief

Lookalike domains and whether email in your name can be forged, with the fix step for your IT provider. Three documents and a signed summary inside 72 hours of confirmation.

Request your firm's brief