Compare approaches
Lookalike-domain monitoring vs. DMARC, SPF and DKIM
They defend against different attacks and neither replaces the other: email authentication stops someone sending mail as your exact domain, while lookalike-domain monitoring finds the separate domain an attacker registered because your DMARC policy worked.
This is the most common mix-up we see. A team publishes a strict DMARC policy, correctly concludes that nobody can spoof their domain in email any more, and assumes domain impersonation is handled. It is not — it is redirected. An attacker blocked from sending as your-company.com simply registers your-company-support.com, authenticates it properly, and passes every check, because the mail genuinely does come from the domain it claims. Here is where the boundary actually falls.
Lookalike-domain monitoring vs DMARC / SPF / DKIM, side by side
| Aspect | Lookalike-domain monitoring | DMARC / SPF / DKIM |
|---|---|---|
| Attack it addresses | A different domain that resembles yours — in email, in a browser, or on a cloned page. | Unauthorised mail claiming to be from your exact domain. |
| Where it acts | Outside your perimeter — domains you do not own and cannot configure. | In DNS records you publish for your own domain. |
| Effect on lookalikes | Detects them, scores them, and captures evidence for takedown. | None. A lookalike domain can publish perfect SPF, DKIM and DMARC of its own. |
| Effect on exact-domain spoofing | None — that is not the attack it looks for. | Blocks it at the receiving mail server when the policy is enforced. |
| Covers web as well as email | Yes — a cloned login page never touches email at all. | No — email only. |
| Cost | A monitoring subscription. | Free to publish; the cost is the configuration and enforcement work. |
When lookalike-domain monitoring is the right call
You need lookalike monitoring when your customers or staff can be reached by something that merely resembles you — which is every brand with a login page, an invoice, or a support channel. It is the only one of the two that sees cloned websites.
When dmarc / spf / dkim is the right call
Publish DMARC, SPF and DKIM first, always, and enforce them. It is free, it is table stakes, and it removes the easiest version of the attack. Anyone selling you monitoring before you have done this has the order wrong.
Where impersona.io fits
impersona.io covers the lookalike side and reports on the other: every brand check includes a read of the scanned domain’s own DMARC, SPF and DKIM posture, so you can see whether the free control is in place before considering the paid one. We would rather tell you to go fix your DMARC record than sell you monitoring on top of an open relay.
Frequently asked questions
Does DMARC stop typosquatting?
No. DMARC governs mail sent from your own domain. A typosquatted or lookalike domain is a different domain, and it can publish its own valid SPF, DKIM and DMARC records — so the mail passes authentication while still impersonating you.
Should I set up DMARC before buying monitoring?
Yes. Email authentication is free and removes the cheapest version of the attack. Monitoring addresses what is left over, which is the larger surface but the more expensive one to watch.
Does email authentication protect a cloned website?
No. SPF, DKIM and DMARC apply to email only. A cloned login page hosted on a lookalike domain and shared over chat, search ads, or SMS never touches your mail flow.
How do I check both at once?
The free brand check reports the scanned domain’s DMARC, SPF and DKIM status alongside the lookalike domains it finds, so you can see the gaps in both layers in one pass.
Related comparisons
See your own exposure first
Your first brand check is free. It generates roughly 160 permutations of your domain and checks them against live DNS and domain registration data.