---
title: "Look-alike domain detection"
description: "OpenEmail checks each sender's domain against twenty brands, decodes letters borrowed from other alphabets, and says in a sentence or two who runs it."
url: "https://openemail.uk/features/sender-research"
---

[Safety & authenticity](https://openemail.uk/features.md#safety)

# Sender research & look-alike domains Who is this, and is the domain a look-alike?

Every incoming message is checked on arrival for a domain spelt to pass as a known brand. A card above the sender's message holds a short note on who runs that domain.

[Open mail](https://openemail.uk/mail/inbox) [Get Started](https://openemail.uk/signup.md)[All features](https://openemail.uk/features.md)

In short

## What is a look-alike domain?

Someone registers a domain that reads at a glance as a better known one, like paypaI.com. Its owner can make it pass DMARC and DKIM, which prove which domain sent a message, not what it resembles.

20

Brands every sender's domain is compared with

2

Edits from a brand name that still count

1

Lookup per domain, shared by the workspace

How it works

## One question, about the domain

Only the domain is asked about, never the sender's name or the message. The answer is kept for later mail from it.

## Near misses and borrowed letters

A domain within two edits of one of twenty brands, or a brand with something bolted on, is called out. Borrowed letters are decoded first.

## The warning waits for a second sign

A near miss that passes its own DMARC and DKIM scores 18, under the warning line of 30. A disguised link or an executable attachment tips it over.

What you get

## In the product today

Mixed alphabets

Latin mixed with Cyrillic or Greek in one word is flagged, whatever it imitates.

Claimed brand names

A sender calling itself PayPal from another domain is flagged too.

Background, not a verdict

The note summarises the domain. It never reads the message.

Good practice

## Getting the most out of it

1. 01
   
   Read the domain
   
   Display names cost nothing to fake. Read what follows the @.
2. 02
   
   Trust the checks first
   
   If the note and the Sender check disagree, believe the check: only it read this message.
3. 03
   
   Skip the link
   
   Asked to sign in or pay? Open the site from your own bookmark.

Where it stands

## Good to know

Questions

## Asked often

Keep going

## Works well with

Phishing & spam filtering

Mail the sending domain itself disowns lands in Spam rather than the inbox.

Verified sender

A mark beside the sender when the sending domain’s published records line up.

Block a sender or a domain

One address, or everything from a domain, stopped before it reaches you.

Start

## Your domain, your mail.

Point a domain at OpenEmail and read it in a mailbox built around it. The free plan covers one domain.

[Open mail](https://openemail.uk/mail/inbox) [Get Started](https://openemail.uk/signup.md)[Read the reference](https://openemail.uk/docs/knowledge/safety/sender-research.md)