alesian.security
← Top 100 Domains

amazonaws.com

Number 6 of the Top 100 · Tranco rank 8

amazonaws.com is the domain behind Amazon Web Services. Names under it, such as s3.amazonaws.com or ec2-…compute.amazonaws.com, are servers and storage that AWS customers rent, so a name under amazonaws.com tells you the host is on AWS, not who runs it. Thousands of companies, and some attackers, serve from it.

Can amazonaws.com be forged?

Can amazonaws.com be forged?

Partly. Forged mail goes to the spam folder, where people still find it.

The exact name
quarantine · subdomains none · reports to Your own mailbox
Names that copy
17 registered lookalikes can send mail. DMARC never sees them. See them →

What we noticed

  • Subdomains are at none while the domain is at quarantine. A forger uses a name under the domain, which receivers then deliver.
  • The DMARC policy sends failing mail to the spam folder. A policy of reject stops it.
  • The subdomain policy is none, so a subdomain is not protected.
Senders it names Amazon SES
  • Amazon SES include:amazonses.com

These are the services the records name. A record can name a service no longer used, and a sender can sign without being named.

SPF~all · 5 of 10 lookups · 177 thousand addresses

Flags others · 5 of 10 lookups · 0 of 2 void lookups · 177,136 IPv4 addresses · 0 IPv6 blocks · Includes of its senders

Every term and include
  • their record 177,136 — 5
  • ~all — — —
    • DKIM0 keys found

    We look under the selectors of the services the records name. A domain can have keys we do not find.

    Sending names 2 names, 0 at reject
    NamePolicySPF lookupsReports to
    aws.amazonaws.comnone (inherited)5—
    www.amazonaws.comnone (inherited)5—
    ReportsYour own mailbox

    Aggregate reports (rua) go to mailto:aws-marketing-email-dmarc-rua-reports@dmarc.amazonaws.com. Failure reports (ruf) are asked for.

    Transport MTA-STS none · TLS-RPT none · BIMI none

    MTA-STS asks senders to deliver to amazonaws.com over encrypted connections only. TLS-RPT asks for reports when they cannot. BIMI shows a logo beside mail that passes DMARC at quarantine or reject.

    Read on Oct 28, 2026. Check it again yourself →

    Watch your own domain's mail this way: Sender Security · the DMARC Report