zoom.us
Number 66 of the Top 100 · Tranco rank 74
zoom.us is Zoom, the video meeting service. Meeting links are zoom.us/j/ followed by a number, and fake meeting invitations copy the name.
Can zoom.us be forged?
Can zoom.us be forged?
No. Receivers that check DMARC refuse mail that forges zoom.us or its subdomains.
- The exact name
- reject · subdomains reject · reports to Proofpoint
- Names that copy
- 186 registered lookalikes can send mail. DMARC never sees them. See them →
What we noticed
- include:%{ir}.%{v}.%{d}.spf.has.pphosted.com resolves for each message, so the senders it allows cannot be listed from outside.
- exists:%{i}._spf.mta.salesforce.com resolves for each message, so the senders it allows cannot be listed from outside.
- The SPF record marks an unlisted sender as a soft failure. A hard failure is stronger.
Senders it names Google Workspace, Amazon SES, Mailchimp, +1
- Google Workspace include:_spf.google.com· DKIM key found
- Amazon SES include:amazonses.com
- Mailchimp include:servers.mcsv.net
- Salesforce include:_spf.salesforce.com
- Proofpoint runs its mail hosts
These are the services the records name. A record can name a service no longer used, and a sender can sign without being named.
SPF~all · 6 of 10 lookups · at least 342 thousand addresses
Flags others · 6 of 10 lookups · 0 of 2 void lookups · 342,273 IPv4 addresses · 6 IPv6 blocks · Kept by a sender-policy service
The full list cannot be known from outside: it uses macros.
Every term and include
DKIM5 keys found
- google._domainkey · rsa 1024· Google Workspace
- k1._domainkey · rsa 1024
- mandrill._domainkey · rsa 1024· Mailchimp Mandrill
- s1._domainkey · rsa 2048· SendGrid
- s2._domainkey · rsa 1024· SendGrid
We look under the selectors of the services the records name. A domain can have keys we do not find.
Sending names 34 names, 34 at reject
| Name | Policy | SPF lookups | Reports to |
|---|---|---|---|
| academy.zoom.us | reject (inherited) | — | — |
| admin.zoom.us | reject (inherited) | — | — |
| alpha.zoom.us | reject (inherited) | — | — |
| api.zoom.us | reject (inherited) | 6 | — |
| app.zoom.us | reject (inherited) | 4 | — |
| apps.zoom.us | reject (inherited) | — | — |
| billing.zoom.us | reject (inherited) | 8 | — |
| blog.zoom.us | reject (inherited) | 7 | — |
| build.zoom.us | reject (inherited) | — | — |
| calendar.zoom.us | reject (inherited) | — | — |
| cart.zoom.us | reject (inherited) | — | — |
| chat.zoom.us | reject (inherited) | — | — |
| checkout.zoom.us | reject (inherited) | — | — |
| citrix.zoom.us | reject (inherited) | — | — |
| cloud.zoom.us | reject (inherited) | — | — |
| cms.zoom.us | reject (inherited) | — | — |
| cn.zoom.us | reject (inherited) | — | — |
| community.zoom.us | reject (inherited) | — | — |
| confluence.zoom.us | reject (inherited) | — | — |
| connect.zoom.us | reject (inherited) | — | — |
| console.zoom.us | reject (inherited) | — | — |
| demo.zoom.us | reject (inherited) | — | — |
| docker.zoom.us | reject (inherited) | — | — |
| elastic.zoom.us | reject (inherited) | — | — |
| emea.zoom.us | reject (inherited) | — | — |
| files.zoom.us | reject (inherited) | — | — |
| free.zoom.us | reject (inherited) | — | — |
| github.zoom.us | reject (inherited) | — | — |
| gitlab.zoom.us | reject (inherited) | — | — |
| go.zoom.us | reject (inherited) | — | — |
| grafana.zoom.us | reject (inherited) | — | — |
| home.zoom.us | reject (inherited) | — | — |
| idp.zoom.us | reject (inherited) | — | — |
| investor.zoom.us | reject (inherited) | — | — |
The first 50 names are checked.
ReportsProofpoint
Aggregate reports (rua) go to mailto:sesbounce@zoom.us, mailto:dmarc_rua@emaildefense.proofpoint.com. No failure reports are asked for.
Transport MTA-STS none · TLS-RPT none · BIMI none
MTA-STS asks senders to deliver to zoom.us over encrypted connections only. TLS-RPT asks for reports when they cannot. BIMI shows a logo beside mail that passes DMARC at quarantine or reject.
Read on Oct 28, 2026. Check it again yourself →
Watch your own domain's mail this way: Sender Security · the DMARC Report