azure.com
Number 24 of the Top 100 · Tranco rank 28
azure.com is the home of Microsoft Azure, Microsoft's cloud. The portal and documentation live here; the services customers run are mostly under windows.net and azure.net.
Can azure.com be forged?
Can azure.com be forged?
The name is refused; *.azure.com is not.
- The exact name
- reject · subdomains none · no reports asked for
- Names that copy
- 131 registered lookalikes can send mail. DMARC never sees them. See them →
What we noticed
- Subdomains are at none while the domain is at reject. A forger uses a name under the domain, which receivers then deliver.
- exists:%{i}._spf.sparkpostmail.com resolves for each message, so the senders it allows cannot be listed from outside.
- The subdomain policy is none, so a subdomain is not protected.
Senders it names SparkPost
- SparkPost include:sparkpostmail.com
- Microsoft 365 runs its mail hosts
These are the services the records name. A record can name a service no longer used, and a sender can sign without being named.
SPF~all · 2 of 10 lookups · at least 0 addresses
Flags others · 2 of 10 lookups · 0 of 2 void lookups · 0 IPv4 addresses · 0 IPv6 blocks · Kept by a sender-policy service
The full list cannot be known from outside: it uses macros.
Every term and include
DKIM0 keys found
We look under the selectors of the services the records name. A domain can have keys we do not find.
Sending names none found
No subdomain of azure.com that we found publishes mail records.
ReportsNo reports asked for
Aggregate reports (rua) go to mailto:rua@dmarc.microsoft. Failure reports (ruf) are asked for.
Transport MTA-STS none · TLS-RPT none · BIMI none
MTA-STS asks senders to deliver to azure.com over encrypted connections only. TLS-RPT asks for reports when they cannot. BIMI shows a logo beside mail that passes DMARC at quarantine or reject.
Read on Oct 28, 2026. Check it again yourself →
Watch your own domain's mail this way: Sender Security · the DMARC Report