Definition
Cousin domain
A cousin domain is a domain name registered by a fraudster because it resembles a real company's, one letter changed, a hyphen added, a different extension, and from which they send perfectly authenticated messages.
This is the least-understood limit of DMARC. A message sent from example-ltd.com when your domain is example.com impersonates nothing at all: the fraudster owns that domain, publishes their own SPF, DKIM and DMARC on it, and their message passes every check. Your configuration cannot block it, because your configuration only ever speaks about your domain.
The common variants: a doubled or missing letter, a hyphen added or removed, .com swapped for .co or .net, the word “group” or “global” bolted on, and the homoglyph, which is invisible.
- Also known as
- cousin domain, lookalike domain, typosquatting, doppelganger domain, near-miss domain