alesian.security
← Top 100 Domains

fbcdn.net

Number 11 of the Top 100 · Tranco rank 13

fbcdn.net is Facebook's content delivery network, run by Meta. The photos, videos, profile pictures and scripts you see on Facebook, Instagram and Messenger are served from names under fbcdn.net, such as scontent.xx.fbcdn.net. Your device reaches it whenever one of those apps, or a site with a Facebook embed, loads. It is Meta's own domain and is safe in itself; a name that looks like it but is spelled differently is not.

Can fbcdn.net be forged?

Can fbcdn.net be forged?

Yes. The policy asks only for reports, so forged mail is delivered.

The exact name
none · subdomains none · no reports asked for
Names that copy
26 registered lookalikes can send mail. DMARC never sees them. See them →

What we noticed

  • The DMARC policy only reports. It does not stop mail that fails.
  • The SPF record marks an unlisted sender as a soft failure. A hard failure is stronger.
  • No DKIM selector answered, so the mail of the domain carries no signature.
Senders it names none named

These are the services the records name. A record can name a service no longer used, and a sender can sign without being named.

SPF~all · 1 of 10 lookups · 1 address

Flags others · 1 of 10 lookups · 0 of 2 void lookups · 1 IPv4 addresses · 1 IPv6 blocks · Includes of its senders

Every term and include
  • 1 1 /64s 1
  • ~all — — —
    • DKIM0 keys found

    We look under the selectors of the services the records name. A domain can have keys we do not find.

    Sending names 3 names, 0 at reject
    NamePolicySPF lookupsReports to
    api.fbcdn.netnone (inherited)1—
    apps.fbcdn.netnone (inherited)1—
    www.fbcdn.netnone (inherited)1—

    The first 50 names are checked.

    ReportsNo reports asked for

    Aggregate reports (rua) go to mailto:a@dmarc.facebookmail.com. No failure reports are asked for.

    Transport MTA-STS none · TLS-RPT none · BIMI none

    MTA-STS asks senders to deliver to fbcdn.net over encrypted connections only. TLS-RPT asks for reports when they cannot. BIMI shows a logo beside mail that passes DMARC at quarantine or reject.

    Read on Oct 28, 2026. Check it again yourself →

    Watch your own domain's mail this way: Sender Security · the DMARC Report