alesian.security
← Top 100 Domains

cloudflare.com

Number 2 of the Top 100 · Tranco rank 2

cloudflare.com is the home of Cloudflare, which runs a content delivery network, DNS, and security services in front of millions of other websites. Devices reach it directly for Cloudflare's own dashboard and APIs, and for its WARP client.

Can cloudflare.com be forged?

Can cloudflare.com be forged?

No. Receivers that check DMARC refuse mail that forges cloudflare.com or its subdomains.

The exact name
reject · subdomains reject · reports to Your own mailbox
Names that copy
31 registered lookalikes can send mail. DMARC never sees them. See them →

What we noticed

  • exists:%{i}._spf.mta.salesforce.com resolves for each message, so the senders it allows cannot be listed from outside.
Senders it names Google Workspace, Mailchimp Mandrill, Zendesk, +1
  • Google Workspace include:_spf.google.com
  • Mailchimp Mandrill include:spf.mandrillapp.com· DKIM key found
  • Zendesk include:mail.zendesk.com
  • Salesforce include:_spf.salesforce.com

These are the services the records name. A record can name a service no longer used, and a sender can sign without being named.

SPF-all · 7 of 10 lookups · at least 150 thousand addresses

Refuses others · 7 of 10 lookups · 0 of 2 void lookups · 150,046 IPv4 addresses · 6 IPv6 blocks · Kept by a sender-policy service

The full list cannot be known from outside: it uses macros.

Every term and include
  • 1,024 — —
  • 4,096 — —
  • their record 98,304 1,536 /64s 1
  • their record 20,480 — 1
  • their record 4,736 — 1
  • their record 26,112 — 1
  • their record 30 — 1
  • their record — — 2
  • -all — — —
    • DKIM3 keys found
    • k1._domainkey · rsa 1024
    • mandrill._domainkey · rsa 1024· Mailchimp Mandrill
    • s1._domainkey · rsa 2048· SendGrid

    We look under the selectors of the services the records name. A domain can have keys we do not find.

    Sending names 7 names, 7 at reject
    NamePolicySPF lookupsReports to
    developers.cloudflare.comreject0nowhere
    docs.cloudflare.comreject0nowhere
    investors.cloudflare.comreject (inherited)2—
    learn.cloudflare.comreject (inherited)2—
    live.cloudflare.comreject0Cloudflare
    partners.cloudflare.comreject—Cloudflare
    www.cloudflare.comreject—nowhere

    The first 50 names are checked.

    ReportsYour own mailbox, and elsewhere on 5 names

    Aggregate reports (rua) go to mailto:a1c47f179bc04efd8ee4dcd4d85dfc65@dmarc-reports.cloudflare.net, mailto:rua@cloudflare.com. No failure reports are asked for.

    Transport MTA-STS unknown · TLS-RPT published · BIMI none

    MTA-STS asks senders to deliver to cloudflare.com over encrypted connections only. TLS-RPT asks for reports when they cannot. BIMI shows a logo beside mail that passes DMARC at quarantine or reject.

    Read on Oct 28, 2026. Check it again yourself →

    Watch your own domain's mail this way: Sender Security · the DMARC Report