alesian.security
← Top 100 Domains

github.com

Number 25 of the Top 100 · Tranco rank 29

github.com is GitHub, where software is written and published, owned by Microsoft. Developer tools reach it to fetch code, and raw files load from githubusercontent.com.

Can github.com be forged?

Can github.com be forged?

Partly. Forged mail goes to the spam folder, where people still find it.

The exact name
quarantine · subdomains reject · reports to Your own mailbox
Names that copy
108 registered lookalikes can send mail. DMARC never sees them. See them →

What we noticed

  • exists:%{i}._spf.mta.salesforce.com resolves for each message, so the senders it allows cannot be listed from outside.
  • The DMARC policy sends failing mail to the spam folder. A policy of reject stops it.
  • The SPF record marks an unlisted sender as a soft failure. A hard failure is stronger.
Senders it names Microsoft 365, Google Workspace, Zendesk, +4
  • Microsoft 365 include:spf.protection.outlook.com· DKIM key found
  • Google Workspace include:_netblocks.google.com· DKIM key found
  • Zendesk include:mail.zendesk.com· DKIM key found
  • Salesforce include:_spf.salesforce.com
  • Mailchimp include:servers.mcsv.net· DKIM key found
  • Marketo include:mktomail.com
  • SendGrid include:sendgrid.net· DKIM key found
  • Microsoft 365 runs its mail hosts

These are the services the records name. A record can name a service no longer used, and a sender can sign without being named.

SPF~all · 10 of 10 lookups · at least 932 thousand addresses

Flags others · 10 of 10 lookups · 0 of 2 void lookups · 932,421 IPv4 addresses · 11 IPv6 blocks · Kept by a sender-policy service

The full list cannot be known from outside: it uses macros.

Every term and include
  • 1,024 — —
  • their record 458,752 118,784 /64s 1
  • their record 98,304 — 1
  • their record — 2^31 /64s 1
  • their record 26,112 — 1
  • their record — — 2
  • their record 86,016 — 1
  • their record 21,057 — 1
  • their record 241,152 — 2
  • 1 — —
  • 1 — —
  • 1 — —
  • 1 — —
  • ~all — — —
    • DKIM9 keys found
    • google._domainkey · rsa 2048· Google Workspace
    • k1._domainkey · rsa 1024
    • k2._domainkey · rsa 2048· Mailchimp
    • k3._domainkey · rsa 2048· Mailchimp
    • s1._domainkey · rsa 2048· SendGrid
    • s2._domainkey · rsa 2048· SendGrid
    • selector1._domainkey · rsa 1024· Microsoft 365
    • zendesk1._domainkey · rsa 2048· Zendesk
    • zendesk2._domainkey · rsa 2048· Zendesk

    We look under the selectors of the services the records name. A domain can have keys we do not find.

    Sending names 6 names, 6 at reject
    NamePolicySPF lookupsReports to
    shop.github.comreject (inherited)10—
    storage.github.comreject (inherited)10—
    support.github.comreject (inherited)1—
    test.github.comreject (inherited)1—
    www.github.comreject (inherited)10—
    communication.github.comreject (inherited)0—

    The first 50 names are checked.

    ReportsYour own mailbox

    Aggregate reports (rua) go to mailto:dmarc@github.com. Failure reports (ruf) are asked for.

    Transport MTA-STS none · TLS-RPT none · BIMI none

    MTA-STS asks senders to deliver to github.com over encrypted connections only. TLS-RPT asks for reports when they cannot. BIMI shows a logo beside mail that passes DMARC at quarantine or reject.

    Read on Oct 28, 2026. Check it again yourself →

    Watch your own domain's mail this way: Sender Security · the DMARC Report