alesian.security
← Top 100 Domains

f5.com

Number 81 of the Top 100 · Tranco rank 91

f5.com is F5, a maker of load balancers and application security, and the owner of nginx.

Can f5.com be forged?

Can f5.com be forged?

The name is refused; cloud.f5.com is not.

The exact name
reject · subdomains reject · reports to Valimail
Names that copy
101 registered lookalikes can send mail. DMARC never sees them. See them →

What we noticed

  • exists:%{i}.spf.hc5801-97.iphmx.com resolves for each message, so the senders it allows cannot be listed from outside.
  • exists:%{i}._spf.mta.salesforce.com resolves for each message, so the senders it allows cannot be listed from outside.
Senders it names Microsoft 365, Marketo, Salesforce
  • Microsoft 365 include:spf.protection.outlook.com· DKIM key found
  • Marketo include:mktomail.com· DKIM key found
  • Salesforce include:_spf.salesforce.com

These are the services the records name. A record can name a service no longer used, and a sender can sign without being named.

SPF-all · 5 of 10 lookups · at least 480 thousand addresses

Refuses others · 5 of 10 lookups · 0 of 2 void lookups · 479,813 IPv4 addresses · 5 IPv6 blocks · Kept by a sender-policy service

The full list cannot be known from outside: it uses macros.

Every term and include
  • 1 — —
  • 1 — —
  • 1 — —
  • 1 — —
  • exists:%{i}.spf.hc5801-97.iphmx.com resolves for each message, so its senders cannot be listed — — 1
  • their record 458,752 118,784 /64s 1
  • their record 21,057 — 1
  • their record — — 2
  • -all — — —
    • DKIM6 keys found
    • k1._domainkey · rsa 1024
    • m1._domainkey · rsa 1024· Marketo
    • s1._domainkey · rsa 2048· SendGrid
    • s2._domainkey · rsa 1024· SendGrid
    • selector1._domainkey · rsa 1024· Microsoft 365
    • selector2._domainkey · rsa 2048· Microsoft 365

    We look under the selectors of the services the records name. A domain can have keys we do not find.

    Sending names 5 names, 4 at reject
    NamePolicySPF lookupsReports to
    beta.f5.comreject (inherited)2—
    cloud.f5.comnone5nowhere
    community.f5.comreject (inherited)——
    partner.f5.comreject (inherited)2—
    partners.f5.comreject (inherited)2—

    The first 50 names are checked.

    ReportsValimail, and elsewhere on 1 names

    Aggregate reports (rua) go to mailto:dmarc_agg@vali.email. Failure reports (ruf) are asked for.

    Transport MTA-STS enforce · TLS-RPT published · BIMI none

    MTA-STS asks senders to deliver to f5.com over encrypted connections only. TLS-RPT asks for reports when they cannot. BIMI shows a logo beside mail that passes DMARC at quarantine or reject.

    Read on Oct 28, 2026. Check it again yourself →

    Watch your own domain's mail this way: Sender Security · the DMARC Report