How the mail gets there

Nobody types your domain carefully. Customers guess the .com because that is what a domain is, to them. Mail clients autocomplete the wrong address from a previous typo. A supplier's accounts system was set up years ago by someone reading your name off a business card. Forms on hotel wifi, conference badges, LinkedIn messages: the .com is the default, and every one of these produces a message addressed to it.

If the holder of the .com has no mail server, those messages bounce and the sender may or may not notice. If the holder has a catch-all mailbox, the messages are delivered, read or not, and sit there. Contracts, invoices, password resets, HR correspondence, all of it.

Why it matters more for regulated businesses

A clinic, a law firm or a financial adviser has obligations about where client information goes. A patient who emails their consultant at the wrong domain has disclosed medical information to a third party, and the practice will struggle to explain that the third party was simply whoever registered the .com first.

What DNS records reveal about the exact-match .com

You do not need to send a test email to know whether the exact-match .com can receive mail. Public DNS queries show the posture immediately:

  • Active MX records on the .com: A mail server is listening for messages addressed to that domain. If it belongs to a parking service or an unknown registrant, inbound messages do not bounce at the DNS layer.
  • Null MX (0 .) or no MX/A record: Compliant mail servers reject messages immediately and notify your customer or supplier that they typed the wrong address.
  • SPF and DMARC policy on both domains: Without strict -all SPF and p=reject DMARC on the domains you own, a third party can also send outbound mail that looks indistinguishable from yours.

Use our live Domain & Email Exposure Diagnostic to inspect the MX, SPF, DMARC and RDAP registration posture of both your current domain and the exact-match .com.

The two ways to stop it

The first is to acquire the name. Once the .com is yours, you decide what happens to mail sent to it: forward it, reject it cleanly, or make it the primary address. This is the only complete fix.

The second, when the name cannot be acquired, is hygiene on the names you do hold: publish SPF, DKIM and DMARC so that mail claiming to come from you can be verified; print and link the correct address consistently; and train the people who answer the phone to spell it out. This reduces the volume but does not stop it.

A protection review tells you which of your names are leaking, and by roughly how much, before you decide which route to take.

Next note: How a domain price is reasoned