Lookalike Domain Finder
Free lookalike and cousin-domain finder. It generates typo, homoglyph and TLD variants of your domain and checks which are live and mail-capable - the impersonation domains DMARC cannot stop. Runs in your browser, no login.
About the Lookalike Domain Finder
Attackers do not always spoof your exact domain - often they register a lookalike (or cousin) domain that just resembles yours: a dropped letter, a homoglyph like a 1 for an l, or the same name on a different TLD such as .co, .net or .in. DMARC on your real domain does nothing to stop these, which makes them a favourite vehicle for phishing and business email compromise (BEC).
This finder generates the common typo, homoglyph, TLD-swap and affix variants of your domain and checks each one against public DNS, right in your browser. It reports the ones that are live (they resolve) and flags any that are mail-capable (they have an MX record and can send email) - the higher-risk cases. It is a fast first look; for a graded spoofing and BEC exposure report, run the Spoofing & BEC checker.
Frequently asked questions
What is a lookalike or cousin domain?
A lookalike (or cousin) domain closely resembles yours - a typo, a homoglyph, or the same name on a different TLD such as .co or .net - that an attacker can register to impersonate you. DMARC protects your exact domain but cannot stop a different domain that merely looks like yours.
Does this find every lookalike domain?
No. It generates common typo, homoglyph and TLD variants and reports the ones that currently resolve in DNS. Parked or unregistered variants with no records will not show, and it cannot judge who owns a domain or their intent. It is a fast first look, not an exhaustive registry search.
What does mail-capable mean?
A lookalike marked mail-capable has an MX record, so it can send and receive email. Those are the higher-risk ones, because they can be used to send convincing phishing or BEC messages that appear to come from a domain like yours.
How do I protect against lookalike domains?
You cannot block someone else's domain, but you can enforce DMARC on your own domain, register the most dangerous variants yourself, monitor for new registrations, and train staff to spot them. For a graded spoofing and BEC exposure report, use the Spoofing & BEC checker.
Did this check reveal a problem?
Postbox Consultancy Services fixes email deliverability for a living - 500+ clients over 10+ years. Authentication, blacklist recovery, cold email infrastructure and full audits.