alesian.security
← Top 100 Domains

mozilla.org

Number 93 of the Top 100 · Tranco rank 103

mozilla.org is Mozilla, the non-profit behind Firefox. Firefox reaches it for updates and add-ons.

Can mozilla.org be forged?

Can mozilla.org be forged?

No. Receivers that check DMARC refuse mail that forges mozilla.org or its subdomains.

The exact name
reject · subdomains reject · reports to Valimail
Names that copy
26 registered lookalikes can send mail. DMARC never sees them. See them →

What we noticed

  • include:%{i}._ip.%{h}._ehlo.%{d}._spf.vali.email resolves for each message, so the senders it allows cannot be listed from outside.
  • exists:%{i}._spf.sparkpostmail.com resolves for each message, so the senders it allows cannot be listed from outside.
  • The SPF record marks an unlisted sender as a soft failure. A hard failure is stronger.
Senders it names Google Workspace
  • Google Workspace include:_spf.google.com· DKIM key found
  • Google Workspace runs its mail hosts

These are the services the records name. A record can name a service no longer used, and a sender can sign without being named.

SPF~all · 7 of 10 lookups · at least 102 thousand addresses

Flags others · 7 of 10 lookups · 0 of 2 void lookups · 102,417 IPv4 addresses · 7 IPv6 blocks · Kept by a sender-policy service

The full list cannot be known from outside: it uses macros.

Every term and include
  • include:%{i}._ip.%{h}._ehlo.%{d}._spf.vali.email resolves for each message, so its senders cannot be listed — — 1
  • their record 4,113 2^24 /64s 3
  • their record 98,304 1,536 /64s 1
  • their record — — 2
  • ~all — — —
    • DKIM1 key found
    • google._domainkey · rsa 1024· Google Workspace

    We look under the selectors of the services the records name. A domain can have keys we do not find.

    Sending names 4 names, 4 at reject
    NamePolicySPF lookupsReports to
    community.mozilla.orgreject—Valimail
    events.mozilla.orgreject1Valimail
    support.mozilla.orgreject—Valimail
    addons.mozilla.orgreject (inherited)——

    The first 50 names are checked.

    ReportsValimail, on every name

    Aggregate reports (rua) go to mailto:dmarc_agg@vali.email, mailto:dmarc@mozilla.com. No failure reports are asked for.

    Transport MTA-STS none · TLS-RPT none · BIMI none

    MTA-STS asks senders to deliver to mozilla.org over encrypted connections only. TLS-RPT asks for reports when they cannot. BIMI shows a logo beside mail that passes DMARC at quarantine or reject.

    Read on Oct 28, 2026. Check it again yourself →

    Watch your own domain's mail this way: Sender Security · the DMARC Report