Preventing phishing that uses the company's own domain name

How to close each of these three vectors

For the first vector, the answer is direct: DMARC at p=reject, preceded by full alignment of every legitimate source. The complete process is in getting to p=reject without breaking legitimate email.

For the second, the sp and np tags cover existing and non-existent subdomains respectively — np in particular is an immediate win, with zero false-positive risk.

For the third, the defense changes in nature: since DMARC technically has no leverage over a different domain, what's needed is active monitoring of new registrations resembling the brand name, paired with preemptive registration of the most obvious variants. Several specialized services continuously monitor new domain registrations and raise an alert as soon as a suspicious variant of a brand appears — a valuable early signal, often caught before the first phishing campaign is even launched from that domain, which leaves time to act (cease-and-desist, registrar report, preemptive customer alert) before the attack reaches its target and does any real damage.

Preemptive registration deserves a word of nuance: buying every possible variant is out of reach — the combinations of TLDs, hyphens, and typos are practically endless, and the budget would be better spent elsewhere. The reasonable approach is to register the handful of variants an attacker would pick first (the .com twin of the main TLD, the hyphenated version of a compound name, the one or two most natural typos) and let monitoring cover the rest. Owning ten domains nobody will ever use isn't the goal; removing the cheapest, most credible options from the attacker's menu is.

The role of continuous monitoring

Effective protection against phishing in a brand's name isn't a one-off project but ongoing monitoring, for two reasons. First, attackers regularly test new variants — a domain blocked today doesn't prevent a new variant from being registered tomorrow. Second, the organization's own infrastructure evolves: a new subdomain created by a marketing team, a new sending vendor not yet DKIM-aligned, are all temporary openings that didn't exist at the time of the last security audit and won't show up again until the next one, unless something is watching continuously.

This monitoring is built around three flows worth reading regularly: the DMARC aggregate reports (to detect attempts on the exact domain and its subdomains), a lookalike-domain watch service (for the third vector), and an easy reporting channel for customers and employees who spot a suspicious email (to catch what the first two flows miss, since human eyes still notice things automated monitoring never will).

What a company can communicate to its customers

An organizational measure completes the technical defense: a clear, published explanation of how the company actually communicates — which domains carry its email, whether it ever requests sensitive information that way, what its policy is on links in its communications. A customer who knows that a given brand never asks for a password by email immediately spots a phishing attempt that violates that rule, regardless of the attack's technical sophistication — this simple rule works even against an email that's technically perfectly authenticated but malicious in its content, a case DMARC can never cover, no matter how strict the policy, since authentication only vouches for the sender's identity, not their intentions.

A concrete campaign example, broken down

To make these three vectors tangible, here's how they often combine in a real campaign against an online retailer. The attacker starts by testing the simplest vector: an email claiming to come from orders@example-shop.com, promising a refund following a delivery issue, with a link to a fake payment page designed to collect card details. If the domain has no DMARC enforced, this message goes out normally — no technical barrier stops it, and the campaign can reach thousands of recipients within hours before being noticed, by which point most of the damage is already done.

Once that vector is closed (DMARC at p=reject), the attacker, if they persist, falls back to the second vector: testing plausible subdomains like refund.example-shop.com or customer-service.example-shop.com, hoping they escape the policy enforced on the root domain. Without the np tag, this attempt can succeed, exactly as if the root domain had never been protected.

If the first two vectors are closed, the attacker invests in the third, costlier but still effective: registering example-shop-store.com or a variant with a substituted letter, configuring their own DNS (no security obligation applies to a domain they fully control), and relaunching the same campaign from that new base. This last tier is the one only active monitoring can catch in time, often by watching the domain name's registration itself with public registries, before the first email even goes out — a window measured in days that a manual, periodic check would almost certainly miss.

This progression illustrates why the three defenses need to be planned together from the start, rather than added one by one after each new wave of attack — a determined attacker will systematically test the least-protected vector, and won't simply give up because the first one closed — they'll just move to whichever door is still open.

The reputational cost, beyond the direct financial harm

It's worth putting a number, even a rough one, on what a successful phishing campaign in a company's name costs, beyond the victims' direct financial losses. A company whose name was used in a publicized campaign faces a measurable drop in customer trust, a need for crisis communication, and sometimes questions from its own partners about the soundness of its security practices. For a business whose activity rests on trust — financial services, e-commerce, healthcare — that reputational impact far exceeds the cost of setting up the defenses described here, which, for the first of them at least, remains entirely free and fast to deploy, often in under an hour of DNS work, with no vendor contract or budget approval required to get started.

Checking where the domain stands

Before investing in lookalike-domain monitoring or communication procedures, the first question remains the same as for any anti-spoofing defense: is the exact domain already protected by enforced DMARC? It's the most damaging and simplest vector to close, so it's the absolute priority before tackling the other two — no point investing in sophisticated lookalike-domain watching if the main entry door is still wide open for anyone to walk through unopposed.

The free DMARC analyzer settles the question in seconds, and returns the current configuration in detail — policy, alignment, subdomain coverage.

In summary

Phishing that uses a company's own domain name is the most damaging of all to its brand, precisely because it hijacks the trust that brand built over time. Three distinct vectors — direct spoofing, uncovered subdomains, genuinely registered lookalike domains — call for three different defenses: enforced DMARC, sp/np tags, and active monitoring, each closing a door the other two leave open. Treating all three together, rather than stopping at the first, is what distinguishes real protection from partial protection that still leaves angles open to a patient, methodical attacker.