alesian.security
← Top 100 Domains

google.com

Number 1 of the Top 100 · Tranco rank 1

google.com is Google's main domain. It carries Search, Gmail, Maps, accounts and sign-in, and the APIs behind most Google products, so nearly every phone, browser and network talks to it many times a day.

Can google.com be forged?

Can google.com be forged?

No. Receivers that check DMARC refuse mail that forges google.com or its subdomains.

The exact name
reject · subdomains reject · reports to Your own mailbox
Names that copy
128 registered lookalikes can send mail. DMARC never sees them. See them →

What we noticed

  • The SPF record marks an unlisted sender as a soft failure. A hard failure is stronger.
  • No DKIM selector answered, so the mail of the domain carries no signature.
Senders it names Google Workspace
  • Google Workspace include:_spf.google.com
  • Google Workspace runs its mail hosts

These are the services the records name. A record can name a service no longer used, and a sender can sign without being named.

SPF~all · 1 of 10 lookups · 98 thousand addresses

Flags others · 1 of 10 lookups · 0 of 2 void lookups · 98,304 IPv4 addresses · 6 IPv6 blocks · Includes of its senders

Every term and include
  • 98,304 1,536 /64s 1
  • ~all — — —
    • DKIM0 keys found

    We look under the selectors of the services the records name. A domain can have keys we do not find.

    Sending names 3 names, 3 at reject
    NamePolicySPF lookupsReports to
    accounts.google.comreject1nowhere
    calendar.google.comreject (inherited)1—
    docs.google.comreject—nowhere

    The first 50 names are checked.

    ReportsYour own mailbox, and elsewhere on 2 names

    Aggregate reports (rua) go to mailto:mailauth-reports@google.com. No failure reports are asked for.

    Transport MTA-STS enforce · TLS-RPT published · BIMI none

    MTA-STS asks senders to deliver to google.com over encrypted connections only. TLS-RPT asks for reports when they cannot. BIMI shows a logo beside mail that passes DMARC at quarantine or reject.

    Read on Oct 28, 2026. Check it again yourself →

    Watch your own domain's mail this way: Sender Security · the DMARC Report