vimeo.com
Number 79 of the Top 100 · Tranco rank 89
vimeo.com is Vimeo, a video hosting service used by businesses to embed video on their sites.
Can vimeo.com be forged?
Can vimeo.com be forged?
No. Receivers that check DMARC refuse mail that forges vimeo.com or its subdomains.
- The exact name
- reject · subdomains reject · reports to Valimail
- Names that copy
- 62 registered lookalikes can send mail. DMARC never sees them. See them →
What we noticed
- include:%{i}._ip.%{h}._ehlo.%{d}._spf.vali.email resolves for each message, so the senders it allows cannot be listed from outside.
- The SPF record marks an unlisted sender as a soft failure. A hard failure is stronger.
Senders it names Zendesk, Help Scout, Marketo
- Zendesk include:mail.zendesk.com· DKIM key found
- Help Scout include:helpscoutemail.com
- Marketo include:mktomail.com· DKIM key found
- Google Workspace runs its mail hosts
These are the services the records name. A record can name a service no longer used, and a sender can sign without being named.
SPF~all · 4 of 10 lookups · at least 47 thousand addresses
Flags others · 4 of 10 lookups · 0 of 2 void lookups · 47,175 IPv4 addresses · 0 IPv6 blocks · Kept by a sender-policy service
The full list cannot be known from outside: it uses macros.
Every term and include
DKIM9 keys found
- default._domainkey · rsa 1024
- google._domainkey · rsa 1024· Google Workspace
- k1._domainkey · rsa 1024
- k2._domainkey · rsa 2048· Mailchimp
- k3._domainkey · rsa 2048· Mailchimp
- m1._domainkey · rsa 1024· Marketo
- mandrill._domainkey · rsa 1024· Mailchimp Mandrill
- zendesk1._domainkey · rsa 2048· Zendesk
- zendesk2._domainkey · rsa 2048· Zendesk
We look under the selectors of the services the records name. A domain can have keys we do not find.
Sending names 8 names, 8 at reject
| Name | Policy | SPF lookups | Reports to |
|---|---|---|---|
| dev.vimeo.com | reject (inherited) | 4 | — |
| developer.vimeo.com | reject (inherited) | 4 | — |
| developers.vimeo.com | reject (inherited) | 4 | — |
| help.vimeo.com | reject (inherited) | 1 | — |
| search.vimeo.com | reject (inherited) | 4 | — |
| secure.vimeo.com | reject (inherited) | 4 | — |
| status.vimeo.com | reject (inherited) | 4 | — |
| www.vimeo.com | reject (inherited) | 4 | — |
ReportsValimail
Aggregate reports (rua) go to mailto:dmarc_agg@vali.email, mailto:0bf8497523a6913@rep.dmarcanalyzer.com. Failure reports (ruf) are asked for.
Transport MTA-STS none · TLS-RPT none · BIMI none
MTA-STS asks senders to deliver to vimeo.com over encrypted connections only. TLS-RPT asks for reports when they cannot. BIMI shows a logo beside mail that passes DMARC at quarantine or reject.
Read on Oct 28, 2026. Check it again yourself →
Watch your own domain's mail this way: Sender Security · the DMARC Report