public company · US

Apple

Apple Inc.

Consumer electronics and services.

Primary official domain
apple.com
Reviewed official domains
2 (directory review; organization has not verified)
Directory source
BreachScout directory · Suggest a correction
Matching domains, 30 days
60
registrable domains containing the brand; source date or last feed observation
First source-reported, 30 days
2
domains first source-reported within 30 days
First observed, 30 days
65
domains first observed by DomainSpoof in feeds
Email policy (primary domain)
DMARC quarantine
SPF ~all · 2/10 lookups · checked 2026-10-19 · published policy

What we watch for

Hostnames in phishing feeds and certificate logs are matched on these brand tokens; feed target labels are matched on the aliases. Generated spellings (typos, lure words, look-alike characters, other top-level domains) are derived from the official domains and tokens and checked against feeds, certificate logs and DNS.

Brand tokens
appleidicloud
Label aliases
Apple ID · iCloud · Apple
Official domains
apple.com · icloud.com (all)
Generated spellings
285 tracked · 1 observed somewhere · 284 not observed (all)

Official domains and email policies

Domains reviewed as belonging to Apple. DMARC helps receivers check the From domain; lookalike domains remain possible. Published policies cannot confirm actual mail configuration or receiver behavior.

DomainRelationshipEvidenceDMARC policyPolicy sourceSPFReportingLast check
apple.com
primaryReviewed —
Portfolio directory (wikidata_cik+financedb_ticker): [{"source": "wikidata", "field": "official_website", "original_url": "https://apple.com/", "match_method": "wikidata_cik", "tier": null}, {"source": "wikidata", "field": "official_website", "original_url": "https://apple.com/ae-ar/", "match_method": "wikidata_cik", "tier": null}, {"source": "wikidata", "field": "official_website", "original_url": "https://apple.com/ae/", "match_method": "wikidata_cik", "tier": null}, {"source": "wikidata", "field": "official_website", "original_url": "https://apple.com/am/", "match_method": "wikidata_cik", "tier": null}, {"source": "wikidata", "field": "official_website", "original_url": "https://apple.com/at/", "match_method": "wikidata_cik", "tier": null}, {"source": "wikidata", "field": "official_website", "original_url": "https://apple.com/au/", "match_method": "wikidata_cik", "tier": null}, {"source": "wikidata", "field": "official_website", "original_url": "https://apple.com/az/", "match_method": "wikidata_cik", "tier": null}, {"source": "wikidata", "field": "official_website", "original_url": "https://apple.com/befr/", "match_method": "wikidata_cik", "tier": null}, {"source": "wikidata", "field": "official_website", "original_url": "https://apple.com/benl/", "match_method": "wikidata_cik", "tier": null}, {"source": "wikidata", "field": "official_website", "original_url": "https://apple.com/bg/", "match_method": "wikidata_cik", "tier": null}, {"note": "98 further source rows omitted"}]quarantineDirect~all · 2/10 lookupsAggregate reports requested (rua)2026-10-19 00:41 UTC
Records and check details

Published records

DMARC (_dmarc.apple.com)
v=DMARC1; p=quarantine; sp=reject; rua=mailto:…@rua.agari.com; ruf=mailto:…@ruf.agari.com;
SPF (apple.com)
v=spf1 include:_spf.apple.com include:_spf-txn.apple.com ~all
DKIM
Unknown (no known selector). DKIM use requires a known selector or message to assess; a published key alone cannot confirm signing.

Interpretation

  • p=quarantine: receivers are asked to treat failing mail as suspicious.
  • Subdomain policy sp=reject differs from p=quarantine.
  • Relaxed DKIM alignment (default).
  • Relaxed SPF alignment (default).
  • ~all (softfail): unlisted hosts are marked suspicious; this is not +all and does not by itself bypass DMARC.
  • 2 DNS-querying terms (include, a, mx, ptr, exists, redirect), counted recursively; the limit is 10.
  • Static check of the published record: syntax, every referenced include/redirect record, the DNS-lookup count and a/mx/exists targets (resolved to count void lookups). It does not evaluate SPF for any particular sending host.

DMARC discovery (RFC 9989 tree walk)

  1. _dmarc.apple.com: ok, 1 DMARC record

Recent checks

  • 2026-10-19 00:41 UTC: DMARC quarantine; SPF ~all

Assessment posture-v2. DNS lookup failures leave the policy unknown.

icloud.com
subsidiaryReviewed 2026-10-18
DomainSpoof directory (seed)quarantineDirect~all · 4/10 lookupsAggregate reports requested (rua)2026-10-19 00:41 UTC
Records and check details

Published records

DMARC (_dmarc.icloud.com)
v=DMARC1; p=quarantine; sp=quarantine; rua=mailto:…@rua.agari.com; ruf=mailto:…@ruf.agari.com
SPF (icloud.com)
v=spf1 redirect=_spf.icloud.com
DKIM
Unknown (no known selector). DKIM use requires a known selector or message to assess; a published key alone cannot confirm signing.

Interpretation

  • p=quarantine: receivers are asked to treat failing mail as suspicious.
  • Relaxed DKIM alignment (default).
  • Relaxed SPF alignment (default).
  • ~all (softfail): unlisted hosts are marked suspicious; this is not +all and does not by itself bypass DMARC.
  • 4 DNS-querying terms (include, a, mx, ptr, exists, redirect), counted recursively; the limit is 10.
  • Static check of the published record: syntax, every referenced include/redirect record, the DNS-lookup count and a/mx/exists targets (resolved to count void lookups). It does not evaluate SPF for any particular sending host.

DMARC discovery (RFC 9989 tree walk)

  1. _dmarc.icloud.com: ok, 1 DMARC record

Recent checks

  • 2026-10-19 00:41 UTC: DMARC quarantine; SPF ~all

Assessment posture-v2. DNS lookup failures leave the policy unknown.

“Not checked”: no check yet. “Lookup failed”: DNS result unknown. Report mailbox names are redacted.

Reports on official domains appear under “Official assets with reports” on the Reported matches tab.