netflix.com
Number 38 of the Top 100 · Tranco rank 42
netflix.com is Netflix, the streaming service. Video itself streams from nflxvideo.net, often from servers inside your internet provider.
Can netflix.com be forged?
Can netflix.com be forged?
The name is refused; jobs.netflix.com is not.
- The exact name
- reject · subdomains reject · reports to Your own mailbox
- Names that copy
- 94 registered lookalikes can send mail. DMARC never sees them. See them →
What we noticed
- exists:%{i}._spf.mta.salesforce.com resolves for each message, so the senders it allows cannot be listed from outside.
Senders it names Google Workspace, Amazon SES, Mailchimp, +1
- Google Workspace include:_spf.google.com· DKIM key found
- Amazon SES include:amazonses.com
- Mailchimp include:servers.mcsv.net
- Salesforce include:_spf.salesforce.com
- Google Workspace runs its mail hosts
These are the services the records name. A record can name a service no longer used, and a sender can sign without being named.
SPF-all · 7 of 10 lookups · at least 344 thousand addresses
Refuses others · 7 of 10 lookups · 0 of 2 void lookups · 344,327 IPv4 addresses · 6 IPv6 blocks · Kept by a sender-policy service
The full list cannot be known from outside: it uses macros.
Every term and include
DKIM2 keys found
- google._domainkey · rsa 1024· Google Workspace
- k1._domainkey · rsa 1024
We look under the selectors of the services the records name. A domain can have keys we do not find.
Sending names 13 names, 12 at reject
| Name | Policy | SPF lookups | Reports to |
|---|---|---|---|
| blog.netflix.com | reject (inherited) | 0 | — |
| developer.netflix.com | reject (inherited) | 0 | — |
| ir.netflix.com | reject (inherited) | 0 | — |
| jira.netflix.com | reject (inherited) | — | — |
| jobs.netflix.com | none | 1 | nowhere |
| secure.netflix.com | reject (inherited) | 0 | — |
| shop.netflix.com | reject (inherited) | 0 | — |
| signup.netflix.com | reject (inherited) | 0 | — |
| 360.netflix.com | reject (inherited) | 0 | — |
| android.gameboot.netflix.com | reject (inherited) | 5 | — |
| assetqc.backlot.netflix.com | reject (inherited) | 5 | — |
| billdesk-sihub-encryption.netflix.com | reject (inherited) | 5 | — |
| billdesk-sihub-signature-prod.netflix.com | reject (inherited) | 5 | — |
The first 50 names are checked.
ReportsYour own mailbox, and elsewhere on 1 names
Aggregate reports (rua) go to mailto:netflix@rua.netcraft.com, mailto:dmarcreports@netflix.com, mailto:dmarc_agg@dmarc.250ok.net. Failure reports (ruf) are asked for.
Transport MTA-STS none · TLS-RPT none · BIMI none
MTA-STS asks senders to deliver to netflix.com over encrypted connections only. TLS-RPT asks for reports when they cannot. BIMI shows a logo beside mail that passes DMARC at quarantine or reject.
Read on Oct 28, 2026. Check it again yourself →
Watch your own domain's mail this way: Sender Security · the DMARC Report