All articles in the Email Security category.
DMARC at p=reject stops exact-domain spoofing. Lookalike domains and display-name tricks need other controls. What each attack looks like and a checklist.