May 2, 2026 · 8 min read · PhishingBrand ProtectionDMARC

How to Detect a Phishing Kit Using Your Domain (Before It Costs You Customers)

Someone could be phishing your customers right now using your own domain name — and your legitimate email infrastructure is helping them. Here's how to find out and shut it down.

Here's how phishing works in 2026: an attacker sets up a convincing login page that looks exactly like your app. They buy a domain that looks almost like yours — yourcompany-support.com or yourco-auth.net. They email your customers from an address that appears to be yours. Your customers see your domain in the sender field and trust it completely.

Now imagine the same attack, but the attacker is using your exact domain — not a lookalike. The email comes from [email protected] and the phishing page is at yourcompany.com-support.top. This is brand impersonation via your own infrastructure, and it happens when email authentication is missing or misconfigured.

How Attackers Use Your Domain Without Breaking In

Most businesses don't realize that without proper email authentication (SPF, DKIM, DMARC), anyone can send email that appears to come from your domain. The receiving mail server has no way to verify that the email actually came from you.

What attackers do: they look up your domain, see you're missing DMARC (or have a weak policy), and start sending emails from servers you don't own but that claim to be you. These emails land in inboxes with your domain as the sender — because the receiving servers can't tell the difference.

The DMARC gap: If your domain doesn't have a DMARC record, attackers can send phishing emails that appear to come from your domain to your own customers. Your legitimate email infrastructure doesn't block it. Your customers have no reason to suspect it. And if your support team is CC'd on those phishing threads, you'll never know until a customer flags it.

How to Check If Your Domain Is Being Used for Phishing

1. Check your DMARC, SPF, and DKIM records

Go to your DNS provider and check for these records:

TXT record for _dmarc.yourdomain.com — should exist and have a policy of reject or quarantine, not none
TXT record for _spf.yourdomain.com or your main domain — should list only the servers you actually send email from
DKIM record (usually a CNAME or TXT record for a selector like selector._domainkey.yourdomain.com)

If DMARC shows v=DMARC1; p=none, your domain is being spoofed right now and you have no protection.

2. Search for phishing pages using your brand name

Search Google for: site:yourdomain.com phishing (this won't find everything but can surface known phishing sites using your brand). Also search for your domain in phishing databases like PhishTank and OpenPhish — free to search, updated daily.

3. Monitor Certificate Transparency logs

Attackers often use SSL certificates on phishing sites to appear more legitimate. Search crt.sh for your domain name and any similar variants — look for certificates issued to domains that look like yours (yourco-login.com, yourco-auth.net, etc.). You'll find phishing infrastructure before it's used against your customers if you check regularly.

4. Check for lookalike domains registered recently

Domain registrars won't give you a full list, but you can check newly registered domains that contain your brand name using services like DomainTools or similar OSINT tools. If a domain that looks like yours was registered in the last 30 days and is resolving to a server in a suspicious country, that's a threat to investigate.

What to Do When You Find a Phishing Kit Using Your Brand

Document everything: Screenshot the phishing page, capture the full URL, note the sending domain and email addresses used, record the target audience if known
Report to the registrar: File an abuse report with the domain registrar for the phishing domain — most registrars have an abuse contact and take brand impersonation seriously
Report to Google Safe Browsing: Submit the phishing URL at safeweb.norton.com or Google's Safe Browsing reporting page — they'll add it to blocklists that protect other users
Report to the hosting provider: If the phishing site is hosted on a known provider (Cloudflare, AWS, DigitalOcean), file an abuse report — Cloudflare especially has a strong anti-phishing policy and often takes down phishing sites within hours
Report to email providers: Forward the phishing email (with full headers) to [email protected] or the anti-phishing team at the major email providers (Microsoft, Google, Yahoo)
Inform your customers: If customers were targeted, send a clear, direct email alerting them — include the actual signs of the real vs fake communication

How to Prevent Your Domain From Being Used in Future Phishing

The only real solution is properly configured email authentication:

DMARC with reject policy: This tells receiving mail servers to reject any email claiming to come from your domain that doesn't pass SPF and DKIM checks. It takes time to implement correctly (you need to monitor before enforcing), but it's the most effective protection against domain spoofing.
SPF strictness: Your SPF record should list only the specific servers that send email on your behalf — not include:_spf.google.com plus vague includes. Audit it regularly.
DKIM signing: Ensure all outbound email from your domain is DKIM-signed so receiving servers can verify it hasn't been tampered with.
Monitor your domain reputation: Services like Google Postmaster Tools tell you if your domain is being flagged for spam or phishing — high flag rates can affect your legitimate email delivery.

What to Do Right Now

Check your DMARC record at _dmarc.yourdomain.com — if it doesn't exist or says p=none, that's your highest-priority fix
Set up DMARC monitoring (p=quarantine) for 30 days before switching to p=reject
Search crt.sh for your domain and look for suspicious lookalike domains in the results
Submit any phishing infrastructure you find to the relevant abuse teams

Brand impersonation phishing doesn't require the attacker to compromise your systems — they just need your domain to not be protected. That gap is fixable, and the fix is free. The cost of not fixing it is your customers' trust.

Brand impersonation phishing uses your own domain to betray your customers' trust.

Check If Your Domain Is Being Spoofed →