alesian.security
← Top 100 Domains

spotify.com

Number 57 of the Top 100 · Tranco rank 64

spotify.com is Spotify, the music and podcast service.

Can spotify.com be forged?

Can spotify.com be forged?

No. Receivers that check DMARC refuse mail that forges spotify.com or its subdomains.

The exact name
reject · subdomains reject · reports to dmarcian
Names that copy
77 registered lookalikes can send mail. DMARC never sees them. See them →

What we noticed

  • exists:%{i}._spf.mta.salesforce.com resolves for each message, so the senders it allows cannot be listed from outside.
  • The SPF record marks an unlisted sender as a soft failure. A hard failure is stronger.
Senders it names Google Workspace, Mailchimp, Salesforce, +1
  • Google Workspace include:_spf.google.com· DKIM key found
  • Mailchimp include:servers.mcsv.net
  • Salesforce include:_spf.salesforce.com
  • HubSpot include:21894833.spf06.hubspotemail.net
  • Google Workspace runs its mail hosts

These are the services the records name. A record can name a service no longer used, and a sender can sign without being named.

SPF~all · 6 of 10 lookups · at least 208 thousand addresses

Flags others · 6 of 10 lookups · 0 of 2 void lookups · 207,687 IPv4 addresses · 6 IPv6 blocks · Kept by a sender-policy service

The full list cannot be known from outside: it uses macros.

Every term and include
  • 1 — —
  • 1 — —
  • their record 98,304 1,536 /64s 1
  • their record 86,016 — 1
  • their record — — 2
  • their record 5 — 1
  • their record 23,360 — 1
  • ~all — — —
    • DKIM5 keys found
    • google._domainkey · rsa 1024· Google Workspace
    • k1._domainkey · rsa 1024
    • mandrill._domainkey · rsa 1024· Mailchimp Mandrill
    • s1._domainkey · rsa 2048· SendGrid
    • s2._domainkey · rsa 1024· SendGrid

    We look under the selectors of the services the records name. A domain can have keys we do not find.

    Sending names none found

    No subdomain of spotify.com that we found publishes mail records.

    The first 50 names are checked.

    Reportsdmarcian

    Aggregate reports (rua) go to mailto:6jxge2ly@ag.eu.dmarcian.com. No failure reports are asked for.

    Transport MTA-STS none · TLS-RPT none · BIMI none

    MTA-STS asks senders to deliver to spotify.com over encrypted connections only. TLS-RPT asks for reports when they cannot. BIMI shows a logo beside mail that passes DMARC at quarantine or reject.

    Read on Oct 28, 2026. Check it again yourself →

    Watch your own domain's mail this way: Sender Security · the DMARC Report