Legitimate subdomains versus full lookalike domains

A familiar name in a sender address does not prove that the message came from the organisation it names. Attackers can place convincing content inside a real mailbox, register deceptive domains, or send from a compromised account. The crucial distinction is whether the domain and the specific host are controlled by the organisation you intend to contact.

Start with the registrable domain, not the text displayed beside the logo. Australian users routinely receive electronic bills, bank alerts, parcel notices and government messages, often on a phone while commuting around Sydney or Melbourne. Slowing down to inspect the full hostname prevents a persuasive subject line from making the unsafe part of a link easy to miss.

Separate the subdomain from the registrable domain

The registrable domain is the combination of a registered label with its public suffix. A hostname such as portal.commbank.com.au has a public suffix of com.au and a registrable domain of commbank.com.au. The leftmost label, portal, is a subdomain. By contrast, commbank.com.au.account-check.example.net has the registrable domain account-check.example.net; commbank.com.au is merely a subdomain there, just as a street name in a stranger’s address is not proof of delivery.

Legitimate subdomains are created and delegated by the owner of the registrable domain, often for a portal, login service or regional platform. Control of the parent makes the label plausible, but not its destination automatically safe. A full lookalike imitates the visible name but is registered to someone else, for example commbank-secure.com.au. A domain reputation checker can add registration age, DNS and abuse signals, but reputation is supporting evidence rather than proof of ownership.

Inspect the complete hostname

Read a URL from right to left and stop at the registrable domain. Everything after the first slash is a path, while query parameters can carry tracking or redirect instructions. A URL beginning with https://www.commbank.com.au/ is therefore materially different from https://www.commbank.com.au.login-check.example/, even if both display the same bank name and use a padlock.

Shortened links hide their destination until activated, and redirect chains can change after an initial check. For links claiming to be an Australian electricity, transport or parcel account, expand the destination without opening the original message, then inspect the new hostname. On mobile devices, long URLs may be truncated, so use the app or a known website rather than squeezing more characters into the address bar.

Confirm control through DNS and records

DNS records can show whether a hostname resolves to the expected service. A legitimate portal may use a CNAME to a cloud, identity or payment provider, while the parent domain’s name servers should remain consistent with its known setup. Check A, AAAA, CNAME, MX and name-server records; mismatched destinations, newly activated infrastructure or a parked landing page deserve caution.

Registration records add context. Australian .com.au and .au registrations normally expose registrant details, although privacy choices and registry rules can limit what is visible. A newly registered domain that imitates a familiar brand, uses unrelated name servers or sends all mail to a free provider is stronger evidence of abuse. Conversely, an old domain can still be compromised, so WHOIS age alone never settles the question.

Test SPF, DKIM and DMARC

Email authentication answers a narrower question: was the message authorised to use that sending domain? SPF checks listed sending servers, DKIM signs message content, and DMARC tells receivers what to do when neither passes. The key is alignment: the visible From domain, SPF domain and DKIM domain should normally relate to the organisation and the subdomain being assessed.

Inspect the full message headers when a decision is consequential. A DMARC failure on a purported bank, ATO, health service or Australian energy account is a major warning, while a subdomain may simply have an incomplete rollout and pass through the parent domain’s policy. Authentication can also be configured on criminal infrastructure, so passing records must be combined with domain control and reputation rather than treated as a clean bill of health.

Look for visual and encoded deception

Lookalikes rely on rushed reading as much as on technical tricks. Watch for an added or omitted letter, a plural, a hyphen, or a digit replacing a letter, such as ato.gov.au versus at0.gov.au and my.gov.au versus my-gov.au. Internationalised domain names can also resemble Latin words with non-Latin characters; browsers expose these as punycode, such as xn--, which is a strong reason to stop.

Typography can further disguise intent through unusual capitals, closely matched fonts or a logo captured from a real site. A message may also direct users to a QR code or a shortened URL to avoid exposing the hostname in plain text. If the sender’s domain does not exactly match the official domain used by the relevant Australian bank, utility, government agency or delivery company, verify the message through the organisation’s official app or independently sourced phone number.

Apply Australian legal and market context

Verification also sits within Australian legal and market realities. Many organisations are bound by the Privacy Act 1988 when they handle personal information, while the Spam Act 2003 governs commercial email and consent requirements. Those rules do not authenticate a message, and a lawful sender can still be compromised. Businesses must also avoid deceptive conduct under the Australian Consumer Law, making impersonation and false payment redirects relevant compliance risks.

Before using an online checking service, understand what data it collects, how long it retains information and whether results are automated indicators rather than legal findings. Trusted Sender Score, operated by Zulu Labs Inc., provides published legal information that is the appropriate place to check those terms. For organisations in Australia, the Australian Signals Directorate’s Essential Eight guidance and ACSC scam advice provide stronger escalation and response guidance than visual inspection alone.

Use a repeatable verification routine

Use a consistent sequence: identify the registrable domain, compare it with a trusted source, inspect DNS, test SPF, DKIM and DMARC, check reputation, and confirm unusual requests independently. Record the headers and the exact hostname rather than relying on a screenshot of the sender name. If the organisation uses a legitimate subdomain but the request is unusual, contact the organisation through its saved app or published contact details.

For teams that screen many domains, bulk checking and an API can embed the same controls into ticketing, email gateways and partner onboarding. Quarantine uncertain messages, preserve evidence and report confirmed phishing to the relevant provider, Scamwatch or the targeted institution. Treat every unexplained domain, authentication mismatch or request for credentials or payment as a reason to stop until the destination has been proved by an independent channel.