apple.com
Number 8 of the Top 100 · Tranco rank 10
apple.com is Apple's main domain. Its store, support, software updates, and the services iPhones and Macs check in with all run under it.
Can apple.com be forged?
Can apple.com be forged?
Partly. Forged mail goes to the spam folder, where people still find it.
- The exact name
- quarantine · subdomains reject · reports to Fortra Agari
- Names that copy
- 138 registered lookalikes can send mail. DMARC never sees them. See them →
What we noticed
- The DMARC policy sends failing mail to the spam folder. A policy of reject stops it.
- The SPF record marks an unlisted sender as a soft failure. A hard failure is stronger.
Senders it names none named
These are the services the records name. A record can name a service no longer used, and a sender can sign without being named.
SPF~all · 2 of 10 lookups · 1,581 addresses
Flags others · 2 of 10 lookups · 0 of 2 void lookups · 1,581 IPv4 addresses · 0 IPv6 blocks · Includes of its senders
Every term and include
DKIM2 keys found
- selector1._domainkey · rsa 1024· Microsoft 365
- selector2._domainkey · rsa 1024· Microsoft 365
We look under the selectors of the services the records name. A domain can have keys we do not find.
Sending names 3 names, 1 at reject
| Name | Policy | SPF lookups | Reports to |
|---|---|---|---|
| asia.apple.com | quarantine | 2 | Fortra Agari |
| id.apple.com | reject | 8 | Fortra Agari |
| store.apple.com | quarantine | — | Fortra Agari |
ReportsFortra Agari, on every name
Aggregate reports (rua) go to mailto:d@rua.agari.com. Failure reports (ruf) are asked for.
Transport MTA-STS none · TLS-RPT none · BIMI none
MTA-STS asks senders to deliver to apple.com over encrypted connections only. TLS-RPT asks for reports when they cannot. BIMI shows a logo beside mail that passes DMARC at quarantine or reject.
Read on Oct 28, 2026. Check it again yourself →
Watch your own domain's mail this way: Sender Security · the DMARC Report