alesian.security
← Top 100 Domains

cdninstagram.com

Number 76 of the Top 100 · Tranco rank 86

cdninstagram.com serves the photos and videos on Instagram. It is Meta's own.

Can cdninstagram.com be forged?

Can cdninstagram.com be forged?

Yes. There is no DMARC record, so each receiver decides alone.

The exact name
no DMARC record
Names that copy
0 registered lookalikes can send mail. DMARC never sees them. See them →

What we noticed

  • The domain has no DMARC record, so a receiver has no instruction for mail that fails.
  • The domain runs no mail service and sets no policy, so anybody can send mail in its name.
  • The SPF record marks an unlisted sender as a soft failure. A hard failure is stronger.
Senders it names none named

These are the services the records name. A record can name a service no longer used, and a sender can sign without being named.

SPF~all · 1 of 10 lookups · 0 addresses

Flags others · 1 of 10 lookups · 1 of 2 void lookups · 0 IPv4 addresses · 0 IPv6 blocks · Includes of its senders

Every term and include
  • a answers no address — — 1
  • ~all — — —
    • DKIM0 keys found

    We look under the selectors of the services the records name. A domain can have keys we do not find.

    Sending names 2 names, 0 at reject
    NamePolicySPF lookupsReports to
    static.cdninstagram.comabsent (inherited)1—
    video.cdninstagram.comabsent (inherited)1—
    ReportsNo reports asked for

    Aggregate reports (rua) go to nobody. No failure reports are asked for.

    Transport MTA-STS none · TLS-RPT none · BIMI none

    MTA-STS asks senders to deliver to cdninstagram.com over encrypted connections only. TLS-RPT asks for reports when they cannot. BIMI shows a logo beside mail that passes DMARC at quarantine or reject.

    Read on Oct 28, 2026. Check it again yourself →

    Watch your own domain's mail this way: Sender Security · the DMARC Report