microsoft.com
Number 5 of the Top 100 · Tranco rank 6
microsoft.com is Microsoft's corporate domain. It carries product pages, downloads, documentation and support, and Windows reaches it for licensing, updates and connectivity checks.
Can microsoft.com be forged?
Can microsoft.com be forged?
The name is refused; accounts.microsoft.com is not.
- The exact name
- reject · subdomains reject · reports to Your own mailbox
- Names that copy
- 110 registered lookalikes can send mail. DMARC never sees them. See them →
Senders it names Microsoft 365
- Microsoft 365 include:spf.protection.outlook.com· DKIM key found
- Microsoft 365 runs its mail hosts
These are the services the records name. A record can name a service no longer used, and a sender can sign without being named.
SPF-all · 7 of 10 lookups · 477 thousand addresses
Refuses others · 7 of 10 lookups · 0 of 2 void lookups · 476,674 IPv4 addresses · 5 IPv6 blocks · Includes of its senders
Every term and include
DKIM1 key found
- selector2._domainkey · rsa 1024· Microsoft 365
We look under the selectors of the services the records name. A domain can have keys we do not find.
Sending names 3 names, 2 at reject
| Name | Policy | SPF lookups | Reports to |
|---|---|---|---|
| account.microsoft.com | reject (inherited) | — | — |
| accounts.microsoft.com | quarantine | — | Fortra Agari |
| email.microsoft.com | reject (inherited) | 7 | — |
The first 50 names are checked.
ReportsYour own mailbox, and elsewhere on 1 names
Aggregate reports (rua) go to mailto:itex-rua@microsoft.com. Failure reports (ruf) are asked for.
Transport MTA-STS enforce · TLS-RPT published · BIMI none
MTA-STS asks senders to deliver to microsoft.com over encrypted connections only. TLS-RPT asks for reports when they cannot. BIMI shows a logo beside mail that passes DMARC at quarantine or reject.
Read on Oct 28, 2026. Check it again yourself →
Watch your own domain's mail this way: Sender Security · the DMARC Report