LookalikeGuardLookalike domains with mail servers (MX)
A lookalike domain only needs a website to phish through a link. To impersonate you by email (fake invoices, password resets, "please update our bank details"), it needs mail servers, published as MX records in DNS. That is why our score treats MX as a strong signal.
Free, no account needed. A scan takes 15 to 60 seconds. You get a shareable result link.
How the scan treats MX
- Real mail host (for example a hosted mail provider or the domain's own server): +15.
- Registrar default, forwarding, parking or "black-hole" MX (common for parked domains, e.g. registrar email-forwarding hosts): 0 points, with the reason shown, because these usually can't send convincing mail.
- No MX at all: no points. The domain can still host a website.
An MX record means a domain can receive mail, and usually that someone set it up to send too. It does not show that it has sent anything. Pair it with the other signals: registration age, whether the page shows your brand, and certificates.
Real examples from our scanner
Copied from LookalikeGuard scans of public brands run on 2026-10-18, 2026-10-19 (UTC). Data comes from public DNS, RDAP registration records, certificate logs and a fetch of the page. A score is an automated risk signal, not a finding that anyone is doing something wrong: many lookalikes are defensive registrations, unrelated businesses or parked pages. Results change over time. Names of medium and high results are partly hidden for that reason.
| Brand | Lookalike | Score | Techniques | Top reasons |
|---|---|---|---|---|
| basecamp.com | bas••••pos.app | 100 (high) | ct-match, ct-seen | +10 Domain is registered (has DNS) +15 Resolves to an IP address, so a website can be live +15 Has mail servers (MX), so it can send or receive email +8 Contains your brand name (found in certificate logs) +15 Registered in the last 90 days (61 days ago) +5 TLS certificate issued 0 days ago |
| basecamp.com | basec•••••ammar.com | 93 (high) | ct-match, ct-seen | +10 Domain is registered (has DNS) +15 Resolves to an IP address, so a website can be live +15 Has mail servers (MX), so it can send or receive email +8 Contains your brand name (found in certificate logs) -15 Registered 8 years ago (long-standing) +5 TLS certificate issued 0 days ago |
| basecamp.com | basecamp.app | 7 (info) | tld-swap | +10 Domain is registered (has DNS) +15 Resolves to an IP address, so a website can be live +12 Your exact name on a different extension (.app) -15 Registered 8 years ago (long-standing) -15 Looks parked, placeholder or for sale (no real content right now) |
| allbirds.com | all•••dsa.shop | 100 (high) | ct-match, ct-seen | +10 Domain is registered (has DNS) +15 Resolves to an IP address, so a website can be live +15 Has mail servers (MX), so it can send or receive email +8 Contains your brand name (found in certificate logs) +5 TLS certificate issued 0 days ago +5 Serves a live web page (page title hidden) |
| allbirds.com | mya••••rds.com | 55 (medium) | combosquat | +10 Domain is registered (has DNS) +15 Resolves to an IP address, so a website can be live +15 Has mail servers (MX), so it can send or receive email +10 Your name plus the word 'my' +5 Registered within the last year (131 days ago) |
| allbirds.com | shopallbirds.com | 5 (info) | combosquat | +10 Domain is registered (has DNS) +15 Resolves to an IP address, so a website can be live +10 Your name plus the word 'shop' -15 Registered 14 years ago (long-standing) -15 Looks parked, placeholder or for sale (no real content right now) |
| gitlab.com | gitl•••••cure.com | 60 (medium) | combosquat | +10 Domain is registered (has DNS) +15 Resolves to an IP address, so a website can be live +15 Has mail servers (MX), so it can send or receive email +20 Adds a sensitive word: 'secure' |
| gitlab.com | my••••ab.net | 55 (medium) | combosquat | +10 Domain is registered (has DNS) +15 Resolves to an IP address, so a website can be live +15 Has mail servers (MX), so it can send or receive email +10 Your name plus the word 'my' -15 Registered 6 years ago (long-standing) +5 Serves a live web page (page title hidden) |
| gitlab.com | gitlab.org | 2 (info) | tld-swap | +10 Domain is registered (has DNS) +15 Resolves to an IP address, so a website can be live +15 Has mail servers (MX), so it can send or receive email +12 Your exact name on a different extension (.org) -15 Registered 16 years ago (long-standing) +5 TLS certificate issued 18 days ago |
Protecting your own domain
Publishing SPF, DKIM and a DMARC policy for your real domain stops others sending as your exact domain. It does not stop lookalikes, which is the gap this check covers. Related: combosquatting, parked vs live.
What it does not do
LookalikeGuard is monitoring and early warning. It does not take down domains, send legal notices, or give legal advice. Scores are automated and can be wrong in both directions: a high score is a reason to look, not proof of abuse. Many lookalike domains are parked, owned by unrelated businesses, or registered defensively by the brand itself; you can mark those as yours or dismiss them.