Scam Check report, data as of 14 October 2026
Which big brands can scammers impersonate by email?
Scammers send email that appears to come from couriers, banks, tax offices and streaming services. What tells Gmail, Outlook and other mail providers to block that forged mail is a DMARC record on the company's own domain. We read the public records of the 134 brands scammers impersonate most, twice a day, and count the lookalike domains registered against each one.
Key findings
What the records show
- 112 of 134 brands (84%) tell mail servers to reject forged email on their main domain.
- 9 brands do not ask for any blocking on their main domain: 6 only monitor (p=none) and 3 publish no DMARC record at all.
- 4 brands protect one of their domains but not another, including DPD, Lidl, Microsoft and E-ZPass.
- 4,814 registered domains imitate these brands. We could not link 3,065 of them to the brand itself, and 1,593 have mail servers, so they can send or receive email.
- Only 66 brands show a verified logo in supporting inboxes (BIMI), and 12 publish MTA-STS to force encrypted delivery of mail sent to them.
Spoof Protection Index
Main domain protection across all brands
112
strong13
moderate6
weak3
noneStrong: DMARC set to reject for all mail. Moderate: quarantine, or reject for only part of the mail. Weak: monitor only (p=none), receiving servers are not asked to block anything. None: no DMARC record.
26 of 172 official domains
Domains that do not fully block forged email
| Domain | Brand | DMARC | SPF | Level |
|---|---|---|---|---|
| dpd.com | DPD | No DMARC record | Soft (~all) | none |
| e-zpassiag.com | E-ZPass | No DMARC record | Soft (~all) | none |
| o2.co.uk | O2 | No DMARC record | Strict (-all) | none |
| anpost.com | An Post | Monitor only (p=none) | Strict (-all) | weak |
| canada.ca | Canada Revenue Agency | Monitor only (p=none) | Strict (-all) | weak |
| laposte.fr | La Poste | Monitor only (p=none) | Strict (-all) | weak |
| lidl.com | Lidl | Monitor only (p=none) | Strict (-all) | weak |
| lidl.desecondary domain | Lidl | Monitor only (p=none) | Strict (-all) | weak |
| poste.it | Poste Italiane | Monitor only (p=none) | Strict (-all) | weak |
| sunpass.com | SunPass | Monitor only (p=none) | No SPF record | weak |
| airtel.in | Airtel | Quarantine | Strict (-all) | moderate |
| amazon.com | Amazon | Quarantine | Strict (-all) | moderate |
| amazon.co.uksecondary domain | Amazon | Quarantine | Strict (-all) | moderate |
| amazon.desecondary domain | Amazon | Quarantine | Strict (-all) | moderate |
| apple.com | Apple | Quarantine | Soft (~all) | moderate |
| avast.com | Avast | Quarantine | No SPF record | moderate |
| binance.com | Binance | Quarantine | Strict (-all) | moderate |
| disneyplus.com | Disney+ | Quarantine | Strict (-all) | moderate |
| emirates.com | Emirates | Quarantine | Strict (-all) | moderate |
| indiapost.gov.in | India Post | Quarantine | Strict (-all) | moderate |
| office.comsecondary domain | Microsoft | Quarantine | No SPF record | moderate |
| norton.com | Norton | Quarantine | Soft (~all) | moderate |
| revolut.com | Revolut | Quarantine | Soft (~all) | moderate |
| shein.com | Shein | Quarantine | Soft (~all) | moderate |
| uber.com | Uber | Quarantine | Soft (~all) | moderate |
| visa.com | Visa | Quarantine | Soft (~all) | moderate |
Listed per domain, because a brand can be protected on one domain and open on another. Monitor-only is a normal step while a company rolls out DMARC, so it is not proof of carelessness, but until it moves to quarantine or reject, mail providers are not asked to stop forged mail from that domain.
By sector
Which sectors protect their customers best
| Sector | Brands | Strong | Share strong |
|---|---|---|---|
| Antivirus & Tech Support | 3 | 1 | 33% |
| Government & Tax | 11 | 8 | 73% |
| Parcel & Delivery | 20 | 15 | 75% |
| Travel & Transport | 8 | 6 | 75% |
| Streaming & Subscriptions | 4 | 3 | 75% |
| Shopping & Retail | 16 | 13 | 81% |
| Telecom & Utilities | 11 | 9 | 82% |
| Payments & Money Transfer | 13 | 11 | 85% |
| Crypto Exchanges & Wallets | 7 | 6 | 86% |
| Tech & Online Accounts | 10 | 9 | 90% |
| Banks | 23 | 23 | 100% |
| Social Media & Messaging | 8 | 8 | 100% |
Lookalike domains
Brands with the most lookalike domains we could not link to them
| Brand | Owner unknown | All registered | With mail servers |
|---|---|---|---|
| Microsoft | 74 | 80 | 11 |
| 59 | 61 | 2 | |
| Netflix | 55 | 62 | 24 |
| Roblox | 54 | 69 | 31 |
| Binance | 52 | 69 | 15 |
| 47 | 80 | 20 | |
| Disney+ | 44 | 49 | 33 |
| DocuSign | 42 | 55 | 26 |
| TikTok | 42 | 52 | 16 |
| The Home Depot | 41 | 45 | 2 |
| Trust Wallet | 41 | 54 | 16 |
| Ledger | 39 | 49 | 19 |
A registered lookalike is not proof of a scam. Companies often buy typos of their own name, and 825 of the registered domains we found are clearly the brand's own. Each brand page lists the domains as plain text.
Method
How we measure
The list covers 134 brands that are commonly impersonated in phishing, across delivery, banking, payments, retail, government, telecoms, tech, social media, streaming, crypto, travel and security software. For each official domain we read the public DMARC, SPF, BIMI and MTA-STS records through DNS over HTTPS, twice a day. The headline level for a brand comes from its main website domain.
For lookalikes we generate likely imitations of each brand name: typos, swapped or look-alike characters, the name joined to words such as delivery, login or refund, and the name under other domain endings. We record which are registered and which have mail servers, and use name servers to tell the brand's own registrations apart from the rest.
Records can change at any time and these figures reflect the most recent check. You are welcome to quote them with a link to this page. Every brand page shows the records we read, and corrections are welcome through our contact page.