ToolsEmail

Look-alike domain checker

Enter your own domain to see the names an attacker might register to pass for it: typos, look-alike characters, added words and other endings. Then check which are already registered and which could send mail to your staff or customers. For defence: what to register, block or watch.

Variants worked out in your browser
Optional lookups sent via abbott.cloud to Cloudflare DNS and the registries (RDAP)

Find look-alikes of your domain

How this works

Your browser reduces what you entered to the registrable domain (acme-test.org for mail.acme-test.org) and works out look-alikes of its name: missing, doubled, swapped and neighbouring-key letters, vowel swaps, look-alike characters (including letters from other alphabets, shown with their xn-- Punycode form, RFC 3492), hyphens, "www" without the dot, added words such as login or secure, other endings (TLDs), and single-bit changes. Nothing is sent.
They are ranked by how likely each trick is to work, every one is checked to be a legal host name (RFC 1123: labels of at most 63 characters, no leading or trailing hyphen), duplicates are removed, and the list is cut at 600.
If you press "Check which are registered", your browser builds a DNS query for the name servers (NS) of each variant, 100 at a time, and sends them in batches of 20 via abbott.cloud/api/dns to Cloudflare's public resolver. A name the resolver says does not exist (NXDOMAIN) is shown as not registered. A name with name servers is registered. Anything else is unclear.
For the registered names it also asks for MX and A records, to say whether they can receive mail (RFC 5321 §5.1, RFC 7505 for a "null" MX) and have a website address.
"Check registration dates" asks the registry's RDAP service (RFC 9083) via abbott.cloud/api/rdap for up to 10 names and shows their age and registrar. Only the registration date and whether contact details are redacted are read; no names of people are shown.

What's kept: nothing. Your domain goes in the page's address so you can share it, but nothing is stored.

Limitations:

DNS shows that a name is delegated, not who owns it. A registered look-alike may be yours, a partner's or a harmless coincidence. A name with no DNS can still be registered by someone, and a name that is free today may be taken tomorrow.
This is a point-in-time check of the most likely names, not all of them. Certificate transparency logs (RFC 9162) and registrar or registry monitoring services can alert you continuously.
Lookups are limited per visitor, so large checks run at a measured pace and wait if the limit is reached. You can stop at any time.

Code: lookalike.js (this page), lib/lookalike.js (variants and checks), domain.js (names and Punycode), encoding.js (look-alike letters), rdap.js, net.js (requests).