icloud.com
Number 46 of the Top 100 · Tranco rank 52
icloud.com is Apple's iCloud: mail, photos, backups and Find My. iPhones and Macs keep it busy all day.
Can icloud.com be forged?
Can icloud.com be forged?
Partly. Forged mail goes to the spam folder, where people still find it.
- The exact name
- quarantine · subdomains quarantine · reports to Fortra Agari
- Names that copy
- 153 registered lookalikes can send mail. DMARC never sees them. See them →
What we noticed
- The SPF record has a fault: the record has no all mechanism, so it sets no default
- The DMARC policy sends failing mail to the spam folder. A policy of reject stops it.
- No DKIM selector answered, so the mail of the domain carries no signature.
Senders it names iCloud
- iCloud include:_spf.icloud.com
- iCloud runs its mail hosts
These are the services the records name. A record can name a service no longer used, and a sender can sign without being named.
SPFno all · 4 of 10 lookups · 280 thousand addresses
No all term · 4 of 10 lookups · 0 of 2 void lookups · 279,616 IPv4 addresses · 8 IPv6 blocks · Includes of its senders
Every term and include
DKIM0 keys found
We look under the selectors of the services the records name. A domain can have keys we do not find.
Sending names none found
No subdomain of icloud.com that we found publishes mail records.
The first 50 names are checked.
ReportsFortra Agari
Aggregate reports (rua) go to mailto:d@rua.agari.com. Failure reports (ruf) are asked for.
Transport MTA-STS none · TLS-RPT none · BIMI none
MTA-STS asks senders to deliver to icloud.com over encrypted connections only. TLS-RPT asks for reports when they cannot. BIMI shows a logo beside mail that passes DMARC at quarantine or reject.
Read on Oct 28, 2026. Check it again yourself →
Watch your own domain's mail this way: Sender Security · the DMARC Report