Domain names and phishing — how can you protect customers from
Author: Domeny.ForSale editorial team Published Updated
In brief: Registering your main domain alone is not enough, because scammers can use a similar address or spoof the sender of a message. The best protection combines registrar account security, correctly configured SPF, DKIM and DMARC, monitoring of similar domains, and clear rules for communicating with customers.
How domains are used in phishing
Phishing is an attempt to obtain data, money or access through a message or website that impersonates a trusted organisation. An attacker does not need to take over a company’s real domain. More often, they register a deceptively similar address, such as twojsklep-pomoc.pl instead of twojsklep.pl (Polish for “your shop-help” and “your shop”), or replace a letter with another character.
A particular case involves domains that use characters from different alphabets. Some letters can look almost identical even though a system treats them as different characters. Such an address can resemble the correct name, especially on a small screen.
The padlock and HTTPS prefix do not confirm that a website is trustworthy. They primarily mean that the connection to that website is encrypted. A scammer can also obtain a certificate for a domain they have registered.
Protect your domain against takeover
Taking over the main domain is more dangerous than registering a similar address: it allows an attacker to redirect the website, intercept email or change service settings. Access to the registrar’s control panel and the DNS system should be treated as seriously as access to business banking.
The basic procedure includes:
- enabling multi-factor authentication, preferably using a hardware security key or an app rather than SMS alone;
- using a unique password stored in a password manager;
- limiting the number of people with administrative access;
- enabling a domain transfer lock and change notifications, if the registrar offers them;
- recording renewal details and setting up a backup payment method;
- regularly checking DNS records, contacts and accounts authorised to make changes.
DNSSEC protects the integrity of DNS responses using cryptographic signatures. It helps limit spoofing of domain name system responses, but it does not prevent the registration of similar addresses or replace other safeguards. Check availability and the activation process for DNSSEC with your registrar and DNS operator.
Reduce spoofing of company email
SPF, DKIM and DMARC are three email authentication mechanisms that work together. SPF specifies which servers are authorised to send messages for a domain. DKIM adds a signature that allows the recipient to check whether the message has been altered and whether it was signed by the specified domain.
DMARC specifies what the recipient’s server should do with a message that fails the relevant checks, and enables reporting. It is best to begin implementation by taking an inventory of all legitimate senders: company email, the newsletter, the invoicing system, the e-commerce platform and the support ticket tool.
Do not immediately set the most restrictive policy without testing. An overlooked system could then cause legitimate correspondence to be rejected. A safe approach is to configure SPF and DKIM, enable DMARC reporting, correct any sending sources identified as problematic, and then gradually move towards quarantining or rejecting messages.
These mechanisms make it harder to send email with a visible sender address in the genuine domain. However, they will not stop a message sent from a similar domain, so monitoring and customer education are also needed.
Monitor similar addresses and set priorities
It is impossible to register every possible typo across all extensions. Defensive registrations make sense primarily for the most obvious mistakes, key markets and names directly related to login or payments. Every additional domain needs to be renewed and monitored, so a large, neglected portfolio can itself become a risk.
Monitoring should cover new domains similar to the brand, certificate changes, search results and customer reports. A similar name alone does not prove fraud. An alarm should only be raised when there are additional signals, such as a copied login page, a payment form, use of the logo or messages directing customers to a suspicious address.
After detecting abuse, preserve evidence: the full website address, screenshots, the message content together with its headers, and the time of the incident. You can then report the incident to the hosting provider, registrar, email provider or browser provider, depending on how the attack was carried out. Conditions and required forms vary between service providers, so confirm them in their official documentation.
Teach customers to recognise the correct channel
Customers should know which domain the company sends messages from and which address is used for logging in. Security messages must be specific, for example: “We do not ask you to provide your password or a one-time code by email” and “Start a payment only after navigating to your customer account yourself”.
A dedicated address for reporting suspicious messages and a short guide available without logging in are useful solutions. Messages about payments or changes to details should not create unnecessary pressure. A sudden request to transfer money to a new bank account should be confirmed through a second, previously agreed channel.
The first practical step is an audit: check the registrar account, SPF, DKIM and DMARC records, and the list of all systems sending email on the company’s behalf. Only then should you tighten the email policy and start monitoring similar domains.
See also: DNSSEC — is additional protection for your domain worthwhile?
Read also
