alesian.security
← Top 100 Domains

gstatic.com

Number 4 of the Top 100 · Tranco rank 4

gstatic.com is the domain Google uses to serve static files: scripts, style sheets, fonts, images and icons for Search, Gmail, Maps and the other Google products. Android and Chrome also reach it to check whether a network has a working internet connection. Seeing it in a log is normal.

Can gstatic.com be forged?

Can gstatic.com be forged?

Yes. The policy asks only for reports, so forged mail is delivered.

The exact name
none · subdomains none · no reports asked for
Names that copy
30 registered lookalikes can send mail. DMARC never sees them. See them →

What we noticed

  • The record ends in ?all, which says nothing about a sender that is not listed.
  • The DMARC policy only reports. It does not stop mail that fails.
  • The SPF record allows a sender that is not listed, so it gives little protection.
Senders it names none named

These are the services the records name. A record can name a service no longer used, and a sender can sign without being named.

SPF?all · 0 of 10 lookups · 0 addresses

Says nothing · 0 of 10 lookups · 0 of 2 void lookups · 0 IPv4 addresses · 0 IPv6 blocks · Includes of its senders

Every term and include
  • ?all — — —
    • DKIM0 keys found

    We look under the selectors of the services the records name. A domain can have keys we do not find.

    Sending names none found

    No subdomain of gstatic.com that we found publishes mail records.

    ReportsNo reports asked for

    Aggregate reports (rua) go to mailto:mailauth-reports@google.com. No failure reports are asked for.

    Transport MTA-STS none · TLS-RPT none · BIMI none

    MTA-STS asks senders to deliver to gstatic.com over encrypted connections only. TLS-RPT asks for reports when they cannot. BIMI shows a logo beside mail that passes DMARC at quarantine or reject.

    Read on Oct 28, 2026. Check it again yourself →

    Watch your own domain's mail this way: Sender Security · the DMARC Report