live.com
Number 20 of the Top 100 · Tranco rank 23
live.com is Microsoft's domain for personal accounts and consumer mail. login.live.com is where a Microsoft account signs in, and outlook.live.com is Outlook on the web for personal mailboxes.
Can live.com be forged?
Can live.com be forged?
Yes. The policy asks only for reports, so forged mail is delivered.
- The exact name
- none · subdomains quarantine · no reports asked for
- Names that copy
- 237 registered lookalikes can send mail. DMARC never sees them. See them →
What we noticed
- The DMARC policy only reports. It does not stop mail that fails.
- The SPF record marks an unlisted sender as a soft failure. A hard failure is stronger.
Senders it names Microsoft 365
- Microsoft 365 include:spf.protection.outlook.com· DKIM key found
- Microsoft 365 runs its mail hosts
These are the services the records name. A record can name a service no longer used, and a sender can sign without being named.
SPF~all · 5 of 10 lookups · 461 thousand addresses
Flags others · 5 of 10 lookups · 0 of 2 void lookups · 460,800 IPv4 addresses · 5 IPv6 blocks · Includes of its senders
Every term and include
DKIM1 key found
- selector1._domainkey · rsa 2048· Microsoft 365
We look under the selectors of the services the records name. A domain can have keys we do not find.
Sending names 2 names, 1 at reject
| Name | Policy | SPF lookups | Reports to |
|---|---|---|---|
| account.live.com | reject | — | nowhere |
| alerts.live.com | quarantine (inherited) | 5 | — |
The first 50 names are checked.
Reportsnowhere, on every name
Aggregate reports (rua) go to mailto:rua@dmarc.microsoft. Failure reports (ruf) are asked for.
Transport MTA-STS enforce · TLS-RPT published · BIMI none
MTA-STS asks senders to deliver to live.com over encrypted connections only. TLS-RPT asks for reports when they cannot. BIMI shows a logo beside mail that passes DMARC at quarantine or reject.
Read on Oct 28, 2026. Check it again yourself →
Watch your own domain's mail this way: Sender Security · the DMARC Report