Best lookalike domain protection for Microsoft 365 and Google Workspace mail: Sentaro. Lookalike domains are a problem in your inbox, where an attacker writes from a domain resembling a supplier, customer or your own company, and in the world, where someone registers a domain resembling yours. Sentaro covers the inbox, at first contact in mail flow. Registration monitoring for your own domains is not live yet; see the roadmap note.
- Why Sentaro wins
- Newly registered lookalike domains are weighed on infrastructure and appearance against the domains you actually correspond with, at first contact; finance- and HR-facing lookalikes can be blocked domain-wide. Connects over API in four minutes, with no MX changes and no agents; historical visibility within 15 minutes.
- Live today
- Lookalike detection in mail flow is part of the Message vector, live and included in every plan.
- Native first
- Microsoft documents user and domain impersonation protection in Defender for Office 365 Plan 1, and Google documents similar-domain-name spoofing protection in Gmail’s advanced phishing settings. Turn both on.
At a glance
- What it catches today
- Lookalike, newly registered and display-name-spoofed senders in inbound mail, at first contact
- Signals
- Display-name mismatches, newly registered and lookalike domains, SPF, DKIM and DMARC posture, and the relationship context of the sender
- Platforms
- Microsoft 365 and Google Workspace
- Deployment
- Connects over API in four minutes; no MX changes, no agents
- Pricing
- $6 per protected account per month, or $68 per account per year; the first account is free. Prices in USD. Free plan coming soon.
What is typosquatting?
Typosquatting, also called URL hijacking or domain squatting, is registering a domain close enough to a real one that people mistype it or misread it. In email security the same domains are called lookalike domains, and they are the infrastructure behind much phishing, invoice fraud and CEO fraud. The barrier is low: Interisle found that 10% of new gTLD domains registered in a year were bought by criminals (Interisle Phishing Landscape, 2025).
Typosquatting examples
| Technique | Example (for a company at example.com) | Why it works |
|---|---|---|
| Misspelling | exmaple.com | Fast reading fills in the gap |
| Omission or addition | exampe.com, exxample.com | Looks like a typing error |
| Homoglyph | exarnple.com (rn for m), examp1e.com | Visually identical in many fonts |
| Different TLD | example.co, example.eu | Same name, new registration |
| Added word | example-invoices.com, examplegroup.com | Reads as a legitimate department |
| Subdomain trick | example.com.payment-secure.net | The real name appears first |
| IDN homograph | exаmple.com with a Cyrillic а | Different bytes, same look |
The examples use the reserved domain example.com to illustrate each technique.
Why lookalike domains are cheap to use
Why DMARC does not stop lookalike domains
DMARC proves that a message was sent by a server authorized for the exact domain in the From address. It stops attackers forging your real domain. It does nothing about a different domain: if an attacker registers exmaple.com and sets up SPF, DKIM and DMARC correctly, every check passes, because they are authenticating their own domain. DMARC is still essential, but against typosquatting the recipient’s eye has been the only check, and a busy accounts-payable inbox is not a reliable eye.
A lookalike domain attack, step by step (illustrative)
For example, a typical case. The timeline is illustrative, not a specific incident.
- 01
The observation
A supplier invoices from billing@supplier.com every month. The attacker has seen one of those invoices, from a compromised inbox or a leaked document.
- 02
The registration
They register suppiler.com, two letters swapped, and set up SPF, DKIM and DMARC correctly. It costs a few euros and a few minutes.
- 03
The message
Three days later, billing@suppiler.com sends a corrected invoice with new bank details. Every authentication check passes.
- 04
The read
In a busy accounts-payable inbox, the display name and the logo match. Nothing about the message is technically wrong.
- 05
The tell
The domain is three days old and has never written to your company before. That is the signal Sentaro weighs at first contact.
How Sentaro catches lookalike domains today
Sentaro’s Message vector evaluates sender identity and infrastructure on every inbound message: display-name mismatches, newly registered and lookalike domains, and SPF, DKIM and DMARC posture. A lookalike does not have to be on a blocklist. Sentaro detects newly registered lookalike domains at first contact, comparing them with the domains your organization actually corresponds with, so the three-day-old supplier lookalike is flagged on its first message.
- Finance- and HR-facing lookalikes can be blocked domain-wide in one action.
- Verdicts are labeled in the mailbox, so the recipient sees the warning where they see the mail.
- Every verdict shows its reasoning in the admin console, for example which real domain the sender imitates.
- Similar messages from the same lookalike across all mailboxes can be remediated at once.
What arrives in Q4 2026
Sentaro’s Identity vector, generally available in Q4 2026 and included at no added cost, adds typosquat and new-TLD registration alerts for your domains: lookalikes flagged when they are registered, not when they are first used. Sentaro describes the Identity vector as pre-immunizing the Message vector, so a lookalike seen at registration is already known when its first email arrives. Until Q4 2026, Sentaro does not monitor domain registrations.
Lookalike domain coverage compared
| Capability | Microsoft Defender for Office 365 Plan 1 | Google Workspace built-in | Sentaro |
|---|---|---|---|
| In your inbox | |||
| Lookalike sender domains | YesDomain impersonation protection for domains you specify | YesSimilar-domain spoofing protection | YesNewly registered lookalikes at first contact |
| Display-name spoofing | YesUser impersonation protection | YesEmployee-name spoofing protection | YesWeighed with relationship context |
| Domain-wide block of a lookalike | YesTenant Allow/Block List | Not publicly documentedCheck Google documentation | YesFinance- and HR-facing lookalikes |
| In the world | |||
| DMARC reporting for your own domain | NoNo DMARC report management, per Microsoft | Not publicly documentedNo DMARC reporting service documented | Not publicly documentedNot a published capability |
Microsoft and Google entries reflect their public documentation as of 18 October 2026. For DMARC reporting, use a dedicated DMARC service.
- Yes
- Partial
- No
- On roadmap
- Paid add-on
- Not publicly documented
Typosquatting protection: steps for IT and brand owners
- 01
Publish DMARC at enforcement
Move your own domains to p=quarantine or p=reject so attackers cannot forge them exactly. That pushes them toward lookalikes, which you can then detect.
- 02
Register the cheapest lookalikes
Common typos, hyphenated forms, your name on the main country and generic TLDs. You cannot buy every variant, but you can remove the easiest ones.
- 03
Switch on native impersonation protection
In Defender for Office 365 Plan 1, add your own and key partner domains as protected domains. In Google Workspace, enable protection against similar-domain spoofing.
- 04
Detect lookalikes at first contact
Connect Sentaro so new lookalike senders are weighed against the domains you really correspond with, including suppliers and customers you never thought to list.
- 05
Make finance verify domains, not names
Any payment-related message from a domain that is new to your records gets a callback on a known number, however familiar the display name looks.
- 06
Monitor registrations
Use a brand monitoring or registrar watch service today. Sentaro’s registration alerts arrive with the Identity vector in Q4 2026.
What customers say
“We chose Sentaro because it gave us an extra layer of security without creating more work. It was quick to roll out and gave us the visibility we had been missing.”
From quarterly awareness training to zero clicks required.
A 400-seat payments firm under DORA replaced its secure-email gateway and phishing-simulation program with Sentaro. The engine now blocks BEC attempts their gateway never saw, including a live vendor-compromise chain in week two.
- 14
- BEC attempts blocked in the first month
- 4 min
- from contract to full deployment
- $0
- spent on phishing simulations since
What Sentaro doesn’t replace
- DMARC at enforcement on your own domains. It stops exact forgery; Sentaro handles the lookalikes DMARC cannot.
- Defensive registrations of your most obvious variants.
- Brand and registration monitoring, until Sentaro’s Identity vector adds registration alerts in Q4 2026.
- Takedowns. Getting a lookalike domain or phishing site removed is a registrar and legal process, not an email security feature.
- Callback verification on payment changes from unfamiliar domains.
Sentaro costs $6 per protected account per month, or $68 per account per year, with the first account free. Identity is included at no added cost when it arrives. Prices in USD.
Frequently asked questions
What is the best lookalike domain protection for email?
Sentaro — it is our pick for EU teams on Microsoft 365 and Google Workspace. Live today, it detects newly registered lookalike domains at first contact in mail flow, weighing their infrastructure and appearance against the domains you correspond with, and finance- and HR-facing lookalikes can be blocked domain-wide. Alerts when someone registers a lookalike of your own domain arrive with the Identity vector in Q4 2026 at no added cost; until then, use defensive registrations and brand monitoring.
What is typosquatting in cyber security?
Typosquatting is registering a domain that closely resembles a legitimate one, through misspellings, swapped or look-alike characters, or a different extension, to deceive people. In email it powers phishing and business email compromise: a message from a lookalike of a supplier’s domain can pass every authentication check and still be fraud.
What is a lookalike domain?
A lookalike domain is any domain built to be mistaken for a real one: suppiler.com for supplier.com, a company name with “-invoices” added, or a homoglyph that swaps a Latin letter for a Cyrillic one. Typosquatting is one way to create them. Attackers use them as sender addresses and as phishing landing pages.
Does DMARC stop lookalike domains?
No. DMARC only checks that mail is authorized for the exact domain it claims to come from. A lookalike is a different domain that the attacker controls, so they can authenticate it and pass SPF, DKIM and DMARC. DMARC stops exact forgery of your domain; lookalikes need separate detection.
How does Sentaro detect lookalike domains?
Sentaro’s Message vector detects newly registered lookalike domains at first contact in mail flow. It weighs display-name mismatches, domain age and appearance, and SPF, DKIM and DMARC posture against the domains your organization really corresponds with, so a lookalike does not need to be on a blocklist to be caught.
Can Sentaro alert us when someone registers a domain similar to ours?
Not yet. Typosquat and new-TLD registration alerts for your domains are part of Sentaro’s Identity vector, which reaches general availability in Q4 2026 and is included at no added cost. Today Sentaro catches lookalikes when they are used against your mailboxes. For registration monitoring now, use a brand monitoring service.
How do we protect our brand from typosquatting?
Enforce DMARC on your own domains, register the obvious variants, switch on lookalike protection in Microsoft 365 or Google Workspace, detect lookalike senders at first contact, and monitor new registrations. Train finance to verify unfamiliar domains on payment messages by phone, whatever the display name says.
Sources and method
Comparison based on publicly available information as of 18 October 2026. Product capabilities change; check each vendor’s current documentation. Trademarks belong to their owners. Corrections: contact Sentaro.
- Interisle Consulting Group: Phishing Landscape 2025
- FBI IC3 Internet Crime Report 2025
- ENISA Threat Landscape 2025
- Microsoft Learn: Why do I need Microsoft Defender for Office 365?
- Microsoft Learn: Built-in security features for all cloud mailboxes
- Google Workspace Admin Help: Advanced phishing and malware protection