facebook.com
Number 3 of the Top 100 · Tranco rank 3
facebook.com is Facebook, the social network run by Meta. Besides the site and the app, its login and sharing buttons are built into many other sites and apps, so devices reach it even when nobody has Facebook open.
Can facebook.com be forged?
Can facebook.com be forged?
No. Receivers that check DMARC refuse mail that forges facebook.com or its subdomains.
- The exact name
- reject · subdomains reject · no reports asked for
- Names that copy
- 92 registered lookalikes can send mail. DMARC never sees them. See them →
What we noticed
- The SPF record has a fault: the record has no all mechanism, so it sets no default
- No DKIM selector answered, so the mail of the domain carries no signature.
Senders it names none named
These are the services the records name. A record can name a service no longer used, and a sender can sign without being named.
SPFno all · 1 of 10 lookups · 1,792 addresses
No all term · 1 of 10 lookups · 0 of 2 void lookups · 1,792 IPv4 addresses · 0 IPv6 blocks · Includes of its senders
Every term and include
DKIM0 keys found
We look under the selectors of the services the records name. A domain can have keys we do not find.
Sending names 50 names, 50 at reject
| Name | Policy | SPF lookups | Reports to |
|---|---|---|---|
| alpha.facebook.com | reject (inherited) | 1 | — |
| analytics.facebook.com | reject (inherited) | 1 | — |
| api.facebook.com | reject (inherited) | 1 | — |
| api2.facebook.com | reject (inherited) | 1 | — |
| apps.facebook.com | reject (inherited) | 1 | — |
| asia.facebook.com | reject (inherited) | 1 | — |
| beta.facebook.com | reject (inherited) | 1 | — |
| blog.facebook.com | reject (inherited) | 1 | — |
| careers.facebook.com | reject (inherited) | 1 | — |
| community.facebook.com | reject (inherited) | 1 | — |
| connect.facebook.com | reject (inherited) | 1 | — |
| de.facebook.com | reject (inherited) | 1 | — |
| dev.facebook.com | reject (inherited) | 1 | — |
| developer.facebook.com | reject (inherited) | 1 | — |
| developers.facebook.com | reject | 1 | nowhere |
| dns.facebook.com | reject (inherited) | 1 | — |
| eu.facebook.com | reject (inherited) | 1 | — |
| forum.facebook.com | reject (inherited) | 1 | — |
| fr.facebook.com | reject (inherited) | 1 | — |
| free.facebook.com | reject (inherited) | 1 | — |
| gateway.facebook.com | reject (inherited) | 1 | — |
| hr.facebook.com | reject (inherited) | 1 | — |
| login.facebook.com | reject (inherited) | 1 | — |
| m.facebook.com | reject (inherited) | 1 | — |
| mobile.facebook.com | reject (inherited) | 1 | — |
| my.facebook.com | reject (inherited) | 1 | — |
| mysql.facebook.com | reject (inherited) | 1 | — |
| new.facebook.com | reject (inherited) | 1 | — |
| news.facebook.com | reject (inherited) | 1 | — |
| oauth.facebook.com | reject (inherited) | 1 | — |
| okta.facebook.com | reject (inherited) | 1 | — |
| old.facebook.com | reject (inherited) | 1 | — |
| partners.facebook.com | reject | 1 | nowhere |
| pay.facebook.com | reject (inherited) | 1 | — |
| payments.facebook.com | reject (inherited) | 1 | — |
| portal.facebook.com | reject (inherited) | 1 | — |
| prod.facebook.com | reject (inherited) | 1 | — |
| register.facebook.com | reject (inherited) | 1 | — |
| sandbox.facebook.com | reject (inherited) | 1 | — |
| sap.facebook.com | reject (inherited) | 1 | — |
| secure.facebook.com | reject (inherited) | 1 | — |
| shop.facebook.com | reject (inherited) | 1 | — |
| static.facebook.com | reject (inherited) | 1 | — |
| store.facebook.com | reject (inherited) | 1 | — |
| time.facebook.com | reject (inherited) | 1 | — |
| upload.facebook.com | reject (inherited) | 1 | — |
| web.facebook.com | reject (inherited) | 1 | — |
| www.facebook.com | reject (inherited) | 1 | — |
| zoom.facebook.com | reject (inherited) | 1 | — |
| alpha.intern.facebook.com | reject (inherited) | 1 | — |
The first 50 names are checked.
Reportsnowhere, on every name
Aggregate reports (rua) go to mailto:a@dmarc.facebookmail.com. No failure reports are asked for.
Transport MTA-STS testing · TLS-RPT published · BIMI none
MTA-STS asks senders to deliver to facebook.com over encrypted connections only. TLS-RPT asks for reports when they cannot. BIMI shows a logo beside mail that passes DMARC at quarantine or reject.
Read on Oct 28, 2026. Check it again yourself →
Watch your own domain's mail this way: Sender Security · the DMARC Report