Lookalike domain
A domain registered to resemble a real one, such as examp1e.com or example-billing.com, so that mail from it is mistaken for mail from the genuine organization.
What it means
Lookalike domains swap characters (rn for m, 1 for l), add words (example-support.com), change the top-level domain (example.co instead of example.com) or use letters from other scripts. Because the attacker owns the domain, they can publish SPF, DKIM and DMARC records and pass every check. Microsoft notes impersonation can pass email authentication for exactly this reason.
Defences sit on the receiving side: impersonation protection that compares sender domains with protected ones, as in Microsoft Defender for Office 365, and user awareness. Your own DMARC policy cannot stop a lookalike, since it only governs your domain.
Related terms
On this site
Sources
What this definition rests on. The wording is ours; the facts are theirs.
All 432 terms in the glossaryThe wiki: blocklists and bounce codes