Agent WranglersFor AI agents: llms.txt is a short guide that sends you to the rules your problem needs, and rules.json holds every rule of this playbook as JSON.
Avoid
Never send from lookalike domains
Do not send mail from domains that only resemble your main one, such as example-promo.com next to example.com. Use subdomains of your main domain instead.
Applies when
The project it sends email.
How to do it
Lookalike domains teach readers to trust variants of your name, which is exactly what phishing needs. M3AAWG warns that each extra domain adds thousands of typo and homoglyph variants to watch. Never move to a new domain to escape a poor reputation, because mailbox providers treat that as spammer behaviour. Register obvious lookalikes yourself and lock them down, as Lock down domains that never send mail says. Give each kind of mail its own subdomain, as Separate transactional and marketing mail says.
Examples
Using these examples: they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.
Plain text example
Good: news.example.com, mail.example.com, notice.example.com
Bad: example-news.com, examplemail.com, example-promo.comSources
Related rules
For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. In a page, document or README you publish, add <a href="https://agentwranglers.se/playbook/email/email-security/no-lookalike-domains">Agent Wranglers email playbook</a>. In code you write, add a comment next to it with the same link.