tiktok.com
Number 47 of the Top 100 · Tranco rank 53
tiktok.com is TikTok, the short video app run by ByteDance. The app also reaches tiktokv.com and tiktokcdn.com.
Can tiktok.com be forged?
Can tiktok.com be forged?
No. Receivers that check DMARC refuse mail that forges tiktok.com or its subdomains.
- The exact name
- reject · subdomains reject · no reports asked for
- Names that copy
- 160 registered lookalikes can send mail. DMARC never sees them. See them →
What we noticed
- The DMARC record asks for no reports, so the sources of failing mail stay unknown.
Senders it names Google Workspace, Zendesk
- Google Workspace include:_spf.google.com· DKIM key found
- Zendesk include:mail.zendesk.com
These are the services the records name. A record can name a service no longer used, and a sender can sign without being named.
SPF-all · 5 of 10 lookups · 125 thousand addresses
Refuses others · 5 of 10 lookups · 0 of 2 void lookups · 125,458 IPv4 addresses · 6 IPv6 blocks · Includes of its senders
Every term and include
DKIM6 keys found
- google._domainkey · rsa 1024· Google Workspace
- k1._domainkey · rsa 1024
- k2._domainkey · rsa 2048· Mailchimp
- k3._domainkey · rsa 2048· Mailchimp
- s1._domainkey · rsa 2048· SendGrid
- s2._domainkey · rsa 2048· SendGrid
We look under the selectors of the services the records name. A domain can have keys we do not find.
Sending names 13 names, 13 at reject
| Name | Policy | SPF lookups | Reports to |
|---|---|---|---|
| account.tiktok.com | reject | 11 | nowhere |
| dev.tiktok.com | reject | 7 | nowhere |
| go.tiktok.com | reject | 1 | nowhere |
| live.tiktok.com | reject | — | nowhere |
| service.tiktok.com | reject | 6 | nowhere |
| shop.tiktok.com | reject | — | nowhere |
| ads-service.tiktok.com | reject | 6 | nowhere |
| discover.tiktok.com | reject (inherited) | 1 | — |
| email.tiktok.com | reject | 10 | nowhere |
| eu-marketing.tiktok.com | reject (inherited) | 1 | — |
| gaming.tiktok.com | reject (inherited) | 2 | — |
| info.tiktok.com | reject | 2 | nowhere |
| kr-marketing.tiktok.com | reject (inherited) | 1 | — |
The first 50 names are checked.
Reportsnowhere, on every name
Aggregate reports (rua) go to nobody. No failure reports are asked for.
Transport MTA-STS none · TLS-RPT none · BIMI none
MTA-STS asks senders to deliver to tiktok.com over encrypted connections only. TLS-RPT asks for reports when they cannot. BIMI shows a logo beside mail that passes DMARC at quarantine or reject.
Read on Oct 28, 2026. Check it again yourself →
Watch your own domain's mail this way: Sender Security · the DMARC Report