Lookalike Domain BEC - Why DMARC Passes and Phishing Still Gets Through

You have DMARC set to reject. Your SPF is tight. Your DKIM signs every outbound message. Someone sends an email from "rnicrosoft.com" to your CFO and DMARC passes it cleanly. No quarantine, no reject. The phishing email lands in the inbox.

This is not a configuration failure. This is a gap in what DMARC was designed to protect against.

What DMARC actually validates

DMARC (RFC 7489) checks whether the domain in the RFC 5321 Mail From command aligns with the domain in the RFC 5322 From header. It also verifies that the sending server is authorized via SPF and that the message was signed by the correct DKIM key.

What it does not check: whether the From domain looks like your domain to a human reader.

A domain like rnicrosoft.com has its own DNS records. It has its own SPF record. It has its own DKIM key. From DMARC's perspective, this is a perfectly legitimate sending domain - because it is. The attacker owns it completely and legitimately.

The authentication passes. The alignment passes. The phishing email passes.

How lookalike domains work in practice

Lookalike domain attacks - sometimes called cousin domain attacks - rely on visual similarity rather than technical compromise. The attacker registers a domain that an ordinary reader will confuse with the real one.

The most common forms:

Typo squatting - dropping a letter, adding one, or swapping adjacent characters. Microsoft.com becomes microsft.com or rnicrosoft.com. Paypa1.com uses a numeral 1 that resembles a lowercase L.

Cousin domains - registering a different but plausible TLD or subdomain. Yourcompany.net instead of yourcompany.com. Support.yourcompany.com when you do not actually use that subdomain.

IDN homograph attacks - using internationalized domain names where characters from different scripts look identical in a browser. The Cyrillic "а" (U+0430) is visually identical to the Latin "a" (U+0061). An attacker can register xn--80akaf.xn--p1ai and display it as "apple.com" in most browsers.

Subdomain hijacking - finding abandoned or unused subdomains at your vendor or partner domains and using them to send convincing phishing lures.

The cost to register a lookalike domain is often under 10 USD. The attacker does not need to compromise anything. They just need one character that looks close enough.

Why this attack targets BEC specifically

Business Email Compromise (BEC) relies on impersonation, not on malware or malicious links. The emails are often text-only, sent from convincing-looking but illegitimate domains, and addressed to people who are used to receiving invoices and payment requests from finance.

BEC attackers deliberately avoid the infrastructure that would trigger spam filters. They use the same tone, the same urgency patterns, and the same request formats as legitimate vendor communications.

When an attacker registers rnicrosoft.com and sends an invoice request to your AP team, nothing in the email authentication stream flags it as suspicious. SPF passes because rnicrosoft.com has its own record. DKIM passes because they sign with their own key. DMARC passes because the From header (displayed as "Microsoft Finance" but actually from rnicrosoft.com) aligns with their own sending domain.

The email looks clean to every automated check. It depends entirely on the recipient noticing the domain name in the address bar or in the email header.

What DMARC aggregate reports cannot show you about this

Your DMARC aggregate reports tell you which sending domains are passing or failing alignment against your domain. They do not tell you what domains exist that look like yours but have nothing to do with you.

If someone registers rnicrosoft.com and starts sending phishing emails, your DMARC reports will not flag it unless they are sending from your own infrastructure (which they are not). The domain is not related to microsoft.com. It is a completely separate domain with its own DNS records and its own authentication.

You only find out about lookalike domains through:

• User reports (reactive and slow)
• Domain monitoring services that scan for newly registered similar domains
• Threat intelligence feeds that flag known phishing infrastructure

None of this comes from your DMARC reports.

How to detect lookalike domains before attackers use them

1. Discover your own attack surface

List every domain that could plausibly be confused with your primary domain. Include common typos, different TLDs, and the character swaps that are hardest to spot (rn vs m, cl vs d, 0 vs O, 1 vs l).

Automated tools exist for this. DMARCFlow includes similar domain discovery that continuously monitors for new registrations matching your brand patterns.

2. Monitor for new registrations continuously

Lookalike domains are often registered shortly before a targeted campaign. A domain registered 48 hours before a CEO fraud attempt is a stronger signal than a domain registered two years ago.

Set up alerts for any domain matching your patterns. Many WHOIS and DNS monitoring services offer this.

3. Review your vendor and partner domain exposure

Map every third party that sends email on your behalf or references your brand. Check whether their domains are protected with their own SPF, DKIM, and DMARC policies. A compromised vendor domain can be just as effective as a lookalike for impersonation.

4. Train users to check the actual domain

Technical controls alone do not solve lookalike domains. User awareness matters. Train teams to check the actual sender domain in email headers, not just the display name. Make it easy to report suspicious emails quickly.

How DMARCFlow addresses the lookalike domain gap

This is the practical layer that fills the gap DMARC cannot cover - and where DMARCFlow fits directly.

DMARCFlow monitors your DMARC aggregate reports for external domains sending as your brand. Separately, it continuously scans for newly registered domains matching your organization's naming patterns and alerts you when lookalike domains appear. This means you are not waiting for a user to report the phishing email - you are finding the lookalike domain registration before the campaign starts.

The earlier you know about a lookalike domain, the more time you have to take action: contacting the registrar, flagging to email providers, and warning your users before any damage happens.

Quick checklist

• Audit domains that look like yours - typos, different TLDs, similar character swaps
• Set up monitoring for newly registered similar domains
• Review third-party vendor email practices and authentication posture
• Train users to check the actual From domain, not just the display name
• Use DMARCFlow for continuous similar domain discovery and alerting

DMARC is not broken. It is doing exactly what it was designed to do. The lookalike domain gap is a different problem that needs its own solution - and that solution starts with knowing what domains look like yours before an attacker uses them.