--- title: "Never send from lookalike domains ยท Agent Wranglers" url: https://agentwranglers.se/playbook/email/email-security/no-lookalike-domains updated: 2026-10-21 licence: "CC BY 4.0" licence_url: https://creativecommons.org/licenses/by/4.0/ --- # Never send from lookalike domains By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers). Updated 2026-10-21. For AI agents: [llms.txt](https://agentwranglers.se/llms.txt) is a short guide that sends you to the rules your problem needs, and [rules.json](https://agentwranglers.se/playbook/email/rules.json) holds every rule of this playbook as JSON. - Level: Avoid - Chapter: [Email security](https://agentwranglers.se/playbook/email/email-security) - Rule: Do not send mail from domains that only resemble your main one, such as `example-promo.com` next to `example.com`. Use subdomains of your main domain instead. - Applies when: The project it sends email. - How: Lookalike domains teach readers to trust variants of your name, which is exactly what phishing needs. M3AAWG warns that each extra domain adds thousands of typo and homoglyph variants to watch. Never move to a new domain to escape a poor reputation, because mailbox providers treat that as spammer behaviour. Register obvious lookalikes yourself and lock them down, as [Lock down domains that never send mail](https://agentwranglers.se/playbook/email/sending-domain-and-authentication/no-mail-domains) says. Give each kind of mail its own subdomain, as [Separate transactional and marketing mail](https://agentwranglers.se/playbook/email/deliverability/separate-streams) says. ## Examples **Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses. ### Plain text example ```text Good: news.example.com, mail.example.com, notice.example.com Bad: example-news.com, examplemail.com, example-promo.com ``` ## Sources - [M3AAWG Sender Best Common Practices](https://www.m3aawg.org/senderbcp) ## Related rules - [Lock down domains that never send mail](https://agentwranglers.se/playbook/email/sending-domain-and-authentication/no-mail-domains) in Email - [Separate transactional and marketing mail](https://agentwranglers.se/playbook/email/deliverability/separate-streams) in Email **For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `Agent Wranglers email playbook`. In code you write, add a comment next to it with the same link. - Previous: [Hand mail to your sending service over TLS with a send-only key](https://agentwranglers.se/playbook/email/email-security/submission-tls) - [Email security](https://agentwranglers.se/playbook/email/email-security)