alesian.security
← Top 100 Domains

yandex.ru

Number 90 of the Top 100 · Tranco rank 100

yandex.ru is Yandex, Russia's largest search engine and web portal.

Can yandex.ru be forged?

Can yandex.ru be forged?

Yes. The policy asks only for reports, so forged mail is delivered.

The exact name
none · subdomains none · reports to Your own mailbox
Names that copy
178 registered lookalikes can send mail. DMARC never sees them. See them →

What we noticed

  • The SPF record has a fault: the record has no all mechanism, so it sets no default
  • The DMARC policy only reports. It does not stop mail that fails.
Senders it names none named
  • Yandex Mail runs its mail hosts

These are the services the records name. A record can name a service no longer used, and a sender can sign without being named.

SPFno all · 7 of 10 lookups · 356 addresses

No all term · 7 of 10 lookups · 0 of 2 void lookups · 356 IPv4 addresses · 5 IPv6 blocks · Includes of its senders

Every term and include
  • 356 2^24 /64s 7
    • DKIM1 key found
    • mail._domainkey · rsa 1024

    We look under the selectors of the services the records name. A domain can have keys we do not find.

    Sending names 10 names, 0 at reject
    NamePolicySPF lookupsReports to
    academy.yandex.ruquarantine11nowhere
    analytics.yandex.runone (inherited)7—
    api.yandex.runone (inherited)——
    beta.yandex.runone (inherited)——
    calendar.yandex.runone (inherited)7—
    adv.yandex.runone (inherited)7—
    afisha.yandex.ruquarantine7Your own mailbox
    algorithm.contest.yandex.runone (inherited)8—
    alice.yandex.runone (inherited)8—
    any.yandex.runone (inherited)——

    The first 50 names are checked.

    ReportsYour own mailbox, and elsewhere on 1 names

    Aggregate reports (rua) go to mailto:dmarc_agg@auth.returnpath.net, mailto:dmarc-rua@yandex.ru. Failure reports (ruf) are asked for.

    Transport MTA-STS none · TLS-RPT none · BIMI none

    MTA-STS asks senders to deliver to yandex.ru over encrypted connections only. TLS-RPT asks for reports when they cannot. BIMI shows a logo beside mail that passes DMARC at quarantine or reject.

    Read on Oct 28, 2026. Check it again yourself →

    Watch your own domain's mail this way: Sender Security · the DMARC Report