public company · US

Banco Santander, S.A.

Primary official domain
santander.com
Reviewed official domains
1 (directory review; organization has not verified)
Directory source
BreachScout directory · Suggest a correction
Matching domains, 30 days
30
registrable domains containing the brand; source date or last feed observation
First source-reported, 30 days
1
domains first source-reported within 30 days
First observed, 30 days
36
domains first observed by DomainSpoof in feeds
Email policy (primary domain)
DMARC reject
SPF -all · 3/10 lookups · Mail: Not checked · checked 2026-10-18 · published policy

What we watch for

Hostnames in phishing feeds and certificate logs are matched on these brand tokens; feed target labels are matched on the aliases. Generated spellings (typos, lure words, look-alike characters, other top-level domains) are derived from the official domains and tokens and checked against feeds, certificate logs and DNS.

Brand tokens
santander
Label aliases
santander
Official domains
santander.com (all)
Generated spellings
118 tracked · 0 observed somewhere · 118 not observed (all)

Official domains and email policies

Domains reviewed as belonging to Banco Santander, S.A.. DMARC helps receivers check the From domain; lookalike domains remain possible. Published policies cannot confirm actual mail configuration or receiver behavior.

DomainRelationshipEvidenceDMARC policyPolicy sourceSPFReportingMailDKIMMTA-STSLast check
santander.com
primaryReviewed —
Portfolio directory (financedb_ticker_A)rejectDirect-all · 3/10 lookupsAggregate reports requested (rua)Not checkedUnknown (no known selector)
Not checkedNot checked
2026-10-18 22:03 UTC
Records and check details

Published records

DMARC (_dmarc.santander.com)
v=DMARC1; p=reject; fo=1; ri=3600; rua=mailto:…@rua.dmp.cisco.com,mailto:…@gsnetcloud.com; ruf=mailto:…@ruf.dmp.cisco.com,mailto:…@gsnetcloud.com
SPF (santander.com)
v=spf1 exists:%{i}.spf.as.gruposantander.com exists:%{i}.spf.us.gruposantander.com ip4:193.127.0.0/16 ip4:62.164.0.0/17 ip4:170.169.0.0/16 ip4:195.149.208.0/21 ip4:195.43.48.0/22 ip4:200.220.176.0/20 include:spf.protection.outlook.com -all
MX (santander.com)
Not checked
DKIM
Unknown (no known selector). DKIM use requires a known selector or message to assess; a published key alone cannot confirm signing, and no key at the probed common selectors proves nothing.
MTA-STS (_mta-sts.santander.com)
Not checked
TLS-RPT (_smtp._tls.santander.com)
Not checked

Interpretation

  • p=reject: receivers are asked to reject failing mail.
  • Relaxed DKIM alignment (default).
  • Relaxed SPF alignment (default).
  • ri is a legacy tag removed by RFC 9989.
  • -all: unlisted hosts fail SPF.
  • 3 DNS-querying terms (include, a, mx, ptr, exists, redirect), counted recursively; the limit is 10.
  • Checked with an earlier assessment that did not validate IP mechanism syntax or resolve a/mx/exists targets; it is re-assessed on the next check.

Observations

  • Reporting: external destination gsnetcloud.com does not publish report authorization; this affects reporting, not enforcement.

DMARC discovery (RFC 9989 tree walk)

  1. _dmarc.santander.com: ok, 1 DMARC record

Recent checks

  • 2026-10-18 22:03 UTC: DMARC reject; SPF -all

Assessment posture-v1. DNS lookup failures leave the policy unknown.

“Not checked”: no check yet (mail, DKIM and MTA-STS facts were added later, so older checks show “Not checked” for them). “Lookup failed”: DNS result unknown. DKIM is probed at a fixed list of common selectors only. Report mailbox names are redacted.

Reports on official domains appear under “Official assets with reports” on the Reported matches tab.