whatsapp.net
Number 28 of the Top 100 · Tranco rank 32
whatsapp.net is the domain WhatsApp's apps use for messaging, calls and media, run by Meta. Phones with WhatsApp installed keep a connection to it open, so it is constant in network logs.
Can whatsapp.net be forged?
Can whatsapp.net be forged?
Yes. There is no DMARC record, so each receiver decides alone.
- The exact name
- no DMARC record
- Names that copy
- 61 registered lookalikes can send mail. DMARC never sees them. See them →
What we noticed
- The domain has no DMARC record, so a receiver has no instruction for mail that fails.
- The domain runs no mail service and sets no policy, so anybody can send mail in its name.
- No DKIM selector answered, so the mail of the domain carries no signature.
Senders it names none named
These are the services the records name. A record can name a service no longer used, and a sender can sign without being named.
SPF-all · 0 of 10 lookups · 0 addresses
Refuses others · 0 of 10 lookups · 0 of 2 void lookups · 0 IPv4 addresses · 0 IPv6 blocks · Includes of its senders
Every term and include
DKIM0 keys found
We look under the selectors of the services the records name. A domain can have keys we do not find.
Sending names 3 names, 0 at reject
| Name | Policy | SPF lookups | Reports to |
|---|---|---|---|
| api.whatsapp.net | absent (inherited) | 1 | — |
| static.whatsapp.net | absent (inherited) | 1 | — |
| c.whatsapp.net | absent (inherited) | 1 | — |
The first 50 names are checked.
ReportsNo reports asked for
Aggregate reports (rua) go to nobody. No failure reports are asked for.
Transport MTA-STS none · TLS-RPT none · BIMI none
MTA-STS asks senders to deliver to whatsapp.net over encrypted connections only. TLS-RPT asks for reports when they cannot. BIMI shows a logo beside mail that passes DMARC at quarantine or reject.
Read on Oct 28, 2026. Check it again yourself →
Watch your own domain's mail this way: Sender Security · the DMARC Report