Catch impersonated senders before anyone replies
{ "email": "ceo@acme-corp.co", "domain_age": 4, "is_free_email": false, "is_disposable_email": false, "is_dmarc_enforced": false, "is_spf_strict": false, "domain_risk_status": "high" }
The signals that expose an impersonated sender
A free-webmail or disposable address using an executive's name.
.svg)
How to verify a sender before you trust it
Why teams verify senders with Abstract
More Abstract data tools
The best build
on Abstract
Frequently asked questions
What is email impersonation?
Email impersonation is when someone poses as a trusted person or company to trick your team, usually to move money or steal data. It comes in two forms: spoofing a real domain, and registering a lookalike domain that reads almost the same. The goal is to get a busy person to trust the sender and act.
What is CEO fraud?
CEO fraud is a type of impersonation where an attacker poses as an executive and pressures an employee to pay an invoice, send gift cards, or share data fast. The email often comes from a lookalike domain or a free address using the executive's name, counting on urgency and authority to skip the usual checks.
What is the difference between spoofing and impersonation?
Spoofing forges the real domain in the From address, which SPF, DKIM, and DMARC are designed to catch. Impersonation is broader: it also includes lookalike domains and display-name tricks that pass authentication because the sender technically owns that domain. Stopping both needs authentication checks plus domain and sender risk signals.
How do SPF, DKIM, and DMARC stop spoofing?
SPF, DKIM, and DMARC verify that an email actually came from the domain it claims, so they block most direct spoofing of a domain you protect. What they cannot catch is a lookalike domain the attacker legitimately owns, or a free-webmail account using a real name. That gap is where domain-age and sender-risk signals matter.
How can you check if a sender is legitimate?
Check the identity behind the address before you trust it. Look at the domain age, whether it is a free or disposable provider, its DMARC and SPF posture, and its overall risk status. A brand-new lookalike domain with no DMARC and a high risk score is a strong impersonation signal, even when the email looks legitimate.
What is a lookalike domain?
A lookalike domain is one registered to closely resemble a real one, using swaps like rn for m, a different top-level domain, or an extra word. It passes email authentication because the attacker owns it, so authentication alone will not flag it. Domain age and risk signals are what expose it.
How does Abstract help catch impersonated senders?
Abstract verifies the sender identity behind an address in the flows you control, like vendor onboarding, invoice approval, or signup. Call the Email Reputation API to get domain age, free and disposable flags, DMARC and SPF posture, and a risk status. It is a sender-verification layer, not an inbox-security product, so pair it with your email gateway. Start free.
