windows.net
Number 58 of the Top 100 · Tranco rank 65
windows.net is where Microsoft Azure customers' services live: blob.core.windows.net for storage, database.windows.net for databases. Like amazonaws.com, a name under it tells you the host is on Azure, not who runs it, and attackers host files there too.
Can windows.net be forged?
Can windows.net be forged?
The name is refused; login.windows.net is not.
- The exact name
- reject · subdomains reject · no reports asked for
- Names that copy
- 63 registered lookalikes can send mail. DMARC never sees them. See them →
What we noticed
- The SPF record marks an unlisted sender as a soft failure. A hard failure is stronger.
- No DKIM selector answered, so the mail of the domain carries no signature.
Senders it names none named
These are the services the records name. A record can name a service no longer used, and a sender can sign without being named.
SPF~all · 0 of 10 lookups · 0 addresses
Flags others · 0 of 10 lookups · 0 of 2 void lookups · 0 IPv4 addresses · 0 IPv6 blocks · Includes of its senders
Every term and include
DKIM0 keys found
We look under the selectors of the services the records name. A domain can have keys we do not find.
Sending names 2 names, 1 at reject
| Name | Policy | SPF lookups | Reports to |
|---|---|---|---|
| login.windows.net | none | — | nowhere |
| www.windows.net | reject (inherited) | 0 | — |
Reportsnowhere, on every name
Aggregate reports (rua) go to mailto:rua@dmarc.microsoft. Failure reports (ruf) are asked for.
Transport MTA-STS none · TLS-RPT none · BIMI none
MTA-STS asks senders to deliver to windows.net over encrypted connections only. TLS-RPT asks for reports when they cannot. BIMI shows a logo beside mail that passes DMARC at quarantine or reject.
Read on Oct 28, 2026. Check it again yourself →
Watch your own domain's mail this way: Sender Security · the DMARC Report