wordpress.org
Number 43 of the Top 100 · Tranco rank 49
wordpress.org is the home of WordPress, the free software that runs a large share of the world's websites. Sites built on it reach it for updates, plugins and themes.
Can wordpress.org be forged?
Can wordpress.org be forged?
The name is refused; mercantile.wordpress.org is not.
- The exact name
- reject · subdomains reject · no reports asked for
- Names that copy
- 38 registered lookalikes can send mail. DMARC never sees them. See them →
Senders it names Help Scout
- Help Scout include:helpscoutemail.com
These are the services the records name. A record can name a service no longer used, and a sender can sign without being named.
SPF-all · 1 of 10 lookups · 518 addresses
Refuses others · 1 of 10 lookups · 0 of 2 void lookups · 518 IPv4 addresses · 0 IPv6 blocks · Includes of its senders
Every term and include
DKIM2 keys found
- s1._domainkey · rsa 2048· SendGrid
- s2._domainkey · rsa 2048· SendGrid
We look under the selectors of the services the records name. A domain can have keys we do not find.
Sending names 3 names, 2 at reject
| Name | Policy | SPF lookups | Reports to |
|---|---|---|---|
| git.wordpress.org | reject (inherited) | — | — |
| mercantile.wordpress.org | quarantine | 3 | nowhere |
| security.wordpress.org | reject (inherited) | — | — |
Reportsnowhere, on every name
Aggregate reports (rua) go to mailto:dmarc-reports@automattic.com. No failure reports are asked for.
Transport MTA-STS none · TLS-RPT none · BIMI none
MTA-STS asks senders to deliver to wordpress.org over encrypted connections only. TLS-RPT asks for reports when they cannot. BIMI shows a logo beside mail that passes DMARC at quarantine or reject.
Read on Oct 28, 2026. Check it again yourself →
Watch your own domain's mail this way: Sender Security · the DMARC Report