Lookalike domains with MX records: the email risk

Why mail matters more than the website

The lookalike that costs companies the most money rarely has a website. It has a mailbox. The pattern is familiar to anyone in accounts payable: a supplier's real invoice thread, then a reply from acme-supplies[.]co instead of acmesupplies.com, saying the bank details have changed. The FBI's Internet Crime Complaint Center has put business email compromise losses at close to US$3 billion a year in its recent annual reports, more than almost any other category it tracks.

For that to work, the lookalike has to receive the replies. That is what MX records are for, and it is why a lookalike with mail records deserves attention before one with a parked web page.

How many lookalikes can receive email

Greyphish checks DNS, mail records and the website for lookalikes of the public brands it watches. Of the 716 registered lookalikes it checked in the 90 days to 1 October 2026:

Counts use whole-word brand matches; an earlier version counted brand names inside other words.

Homoglyphs had mail records more often than combos, which fits their use: a name that reads as the real one is more useful in a From line than in an address bar. The 60 domains with mail and no website are the ones that a search for phishing sites will never surface.

Not every MX record is a threat. Some registrars and parking services add mail forwarding by default, and brand-protection registrars often configure mail on defensive registrations so that misdirected mail is caught. The record says the domain can receive mail; who reads it is the question.

How to check a lookalike's mail setup

Four lookups tell you most of what you need:

dig +short MX lookalike.example
dig +short A lookalike.example
dig +short TXT lookalike.example | grep spf
dig +short TXT _dmarc.lookalike.example

dnstwist's --mxcheck option goes a step further and tests whether the mail server would accept a message for the lookalike, which is a good way to check a whole list at once. See how to find lookalike domains.

Why your DMARC record does not help here

SPF, DKIM and DMARC on your own domain stop people sending mail that claims to be from yourcompany.com. They say nothing about yourcornpany[.]com. An attacker who registers a lookalike can publish their own SPF, sign with their own DKIM key and set their own DMARC policy, and their mail will pass authentication, because it genuinely comes from the domain it says it does.

Also note that sending needs no MX record at all. A lookalike with no MX can still send a first message; it just cannot receive the reply. That is why the absence of MX lowers the risk without removing it.

What to put in place

• A callback rule for bank changes. Any change to payment details is confirmed by phone, on a number taken from the supplier record, never from the email. This one control defeats most invoice fraud regardless of the domain used.
• Lookalike rules on the mail gateway. Most gateways can flag or quarantine mail from domains close to your own and your top suppliers'. Feed them the lookalikes you find.
• First-contact and external-sender banners. A banner on mail from a domain nobody has corresponded with before is cheap and catches the switch from the real thread to the lookalike.
• Check your suppliers' names too. Attackers impersonate your vendors to you as often as they impersonate you to your customers. Run dnstwist against your largest suppliers' domains and tell them what you find.
• Brief the people who get targeted. Accounts payable, payroll and support should know the exact lookalikes of your name that exist.

Acting on a mail-capable lookalike

If a lookalike with MX records has been used, report it to the registrar with the message and full headers as evidence; suspension stops both sending and receiving. Also report the mail provider the MX records point to, since many hosted mail services will close the account. If it has not been used, block it on your gateway and keep it under watch. The takedown guide has the full sequence.

Every Greyphish finding shows whether the lookalike has mail records and a live site, so the mail-capable ones stand out in the daily digest. Watch one domain free, or every domain you own with Pro.

Questions