googleusercontent.com
Number 33 of the Top 100 · Tranco rank 37
googleusercontent.com is where Google serves content that its users, rather than Google, put there: profile pictures, images in Gmail and Docs, Google Drive downloads, and sites hosted on Google Cloud. Because anyone can put content under it, a link to it is only as trustworthy as whoever shared it.
Can googleusercontent.com be forged?
Can googleusercontent.com be forged?
Yes. The policy asks only for reports, so forged mail is delivered.
- The exact name
- none · subdomains none · no reports asked for
- Names that copy
- 39 registered lookalikes can send mail. DMARC never sees them. See them →
What we noticed
- The record ends in ?all, which says nothing about a sender that is not listed.
- The DMARC policy only reports. It does not stop mail that fails.
- The SPF record allows a sender that is not listed, so it gives little protection.
Senders it names Google Workspace
- Google Workspace include:_spf.google.com
These are the services the records name. A record can name a service no longer used, and a sender can sign without being named.
SPF?all · 1 of 10 lookups · 98 thousand addresses
Says nothing · 1 of 10 lookups · 0 of 2 void lookups · 98,304 IPv4 addresses · 6 IPv6 blocks · Includes of its senders
Every term and include
DKIM0 keys found
We look under the selectors of the services the records name. A domain can have keys we do not find.
Sending names none found
No subdomain of googleusercontent.com that we found publishes mail records.
ReportsNo reports asked for
Aggregate reports (rua) go to mailto:mailauth-reports@google.com. No failure reports are asked for.
Transport MTA-STS none · TLS-RPT none · BIMI none
MTA-STS asks senders to deliver to googleusercontent.com over encrypted connections only. TLS-RPT asks for reports when they cannot. BIMI shows a logo beside mail that passes DMARC at quarantine or reject.
Read on Oct 28, 2026. Check it again yourself →
Watch your own domain's mail this way: Sender Security · the DMARC Report