How to use Trusted Sender Score to test domain impersonation

Email impersonation is rarely just a copied logo. A message may claim to come from your finance team, use a convincing reply address, or rely on a lookalike domain that appears identical at a glance. The practical task is learning how to use Trusted Sender Score to test whether your own domain is being impersonated, then combining its results with message headers and internal records.

Start with a small evidence set rather than one suspicious email. Collect the visible sender address, the domain in the reply address, any linked domain, the full headers, and the date received. These details provide useful comparison points and help distinguish a spoofed identity from an unrelated domain that merely mentions your brand.

Check	What it reveals	Best next action
Root-domain reputation	Existing trust or abuse signals	Compare results with known legitimate traffic
Lookalike domain	Newly registered or suspicious variants	Report abuse and investigate the source
DKIM configuration	Whether messages can be cryptographically signed	Correct selectors, keys, and DNS records
DMARC policy	Whether senders must align and what happens on failure	Progress towards a protective enforcement policy

Prepare the evidence

Write down your legitimate root domain, common sending subdomains, and expected services such as support, billing, or transactional mail. Australian organisations commonly use .com.au or .au, while government entities use .gov.au; include these exact forms when checking for unintended variations.

Export several suspicious messages and redact unnecessary personal information before sharing them with colleagues or third parties. Record where each message appeared and preserve the complete headers. The platform FAQ provides useful guidance on interpreting checks and their limitations.

Run the initial trust checks

Use the free domain lookup to test your legitimate domain first. Confirm that the result reflects the domain you expect, then search each suspicious domain separately. This creates a baseline for identifying missing security records, weak reputation, or configuration issues affecting your own mail.

Repeat the process without including a domain in the search box if that avoids accidental suggestions. Compare the findings with your DNS dashboard and mail provider records, rather than assuming a low or high score alone proves impersonation. A legitimate domain can appear unfamiliar to a reputation service, while a newly registered domain can initially have limited history.

Compare suspicious domain variants

Look for additions, omissions, substitutions, and extra words. A domain might replace “mail” with “mai1,” add “support,” or append a suffix while retaining your brand. Check whether these variants resolve to the same hosting infrastructure as your genuine domain.

Review each result for age, reputation, and authentication signals. If a candidate domain passes its own DKIM checks, it may still impersonate you because the visible sender address is not aligned with your organisation. Domain trust results should therefore be read alongside the exact address shown in the message.

Inspect authentication coverage

SPF, DKIM, and DMARC work together. SPF authorises servers permitted to send for a domain, DKIM signs selected message content, and DMARC ties those checks to the visible From domain. Use the platform’s authentication tools to identify absent records, dangling selectors, or policy gaps.

The ultimate DMARC guide explains alignment, reporting, and policy enforcement in practical terms. Check that SPF includes every legitimate sending service, DKIM keys are current, and DMARC receives reports from a mailbox you monitor.

Verify individual suspicious messages

Compare the message’s From, Reply-To, Return-Path, and Received headers. Authentication-Results can show whether SPF or DKIM passed, but you must also determine whether the authenticated domain aligns with the claimed sender. Headers from several mail servers can reveal a forged chain or an unusual sending path.

Local context makes this particularly important. Australian phishing commonly imitates Australia Post redelivery notices, ATO payment demands, Optus support messages, or banking brands such as NAB. In Sydney and Melbourne, many small businesses operate through Google Workspace or Microsoft 365, so compare suspicious activity against those providers’ legitimate sending patterns.

Reduce impersonation exposure

If impersonation uses your exact domain, tighten your mail configuration and investigate whether an account, forwarding rule, or compromised mailbox is involved. Review SPF for unnecessary authorisation, rotate exposed DKIM keys, and correct any unauthorised sending service listed in DNS.

Move DMARC towards enforcement only after legitimate senders pass alignment. Report abusive domains to their registrar or hosting provider, request takedowns where appropriate, and notify affected customers through a verified channel. Keep a record of each incident, including the domain, evidence, response, and outcome, for law-enforcement or insurer discussions.

Automate ongoing detection

Use bulk domain checking when you need to review several legitimate domains or a portfolio of suspected variants. Run scheduled checks against newly observed lookalikes and compare changes in authentication records, reputation, and DNS configuration over time.

For larger teams, the developer tools and API can place trust verification inside ticketing, mail-processing, or security-monitoring workflows. Send relevant alerts to staff who handle domain registrations and customer support, maintain an accurate list of authorised senders, and treat unexpected authentication changes as incidents requiring investigation.