public company · US

DocuSign

DOCUSIGN, INC.

E-signature; document-review lures.

Primary official domain
docusign.com
Reviewed official domains
2 (directory review; organization has not verified)
Directory source
BreachScout directory · Suggest a correction
Matching domains, 30 days
13
registrable domains containing the brand; source date or last feed observation
First source-reported, 30 days
0
domains first source-reported within 30 days
First observed, 30 days
19
domains first observed by DomainSpoof in feeds
Email policy (primary domain)
DMARC reject
SPF -all · 2/10 lookups · Mail: Not checked · checked 2026-10-18 · published policy

What we watch for

Hostnames in phishing feeds and certificate logs are matched on these brand tokens; feed target labels are matched on the aliases. Generated spellings (typos, lure words, look-alike characters, other top-level domains) are derived from the official domains and tokens and checked against feeds, certificate logs and DNS.

Brand tokens
docusign
Label aliases
DocuSign
Official domains
docusign.com · docusign.net (all)
Generated spellings
202 tracked · 0 observed somewhere · 202 not observed (all)

Official domains and email policies

Domains reviewed as belonging to DocuSign. DMARC helps receivers check the From domain; lookalike domains remain possible. Published policies cannot confirm actual mail configuration or receiver behavior.

DomainRelationshipEvidenceDMARC policyPolicy sourceSPFReportingMailDKIMMTA-STSLast check
docusign.com
primaryReviewed —
Portfolio directory (wikidata_cik+financedb_ticker)rejectDirect-all · 2/10 lookupsAggregate reports requested (rua)Not checkedUnknown (no known selector)
Not checkedNot checked
2026-10-18 22:03 UTC
Records and check details

Published records

DMARC (_dmarc.docusign.com)
v=DMARC1; p=reject; sp=reject; adkim=r; aspf=r; rua=mailto:…@emaildefense.proofpoint.com; ruf=mailto:…@emaildefense.proofpoint.com; fo=1;
SPF (docusign.com)
v=spf1 include:%{ir}.%{v}.%{d}.spf.has.pphosted.com ip4:205.220.176.129 ip4:205.220.164.129 ip4:205.220.166.129 ip4:205.220.177.61 include:_spf.google.com -all
MX (docusign.com)
Not checked
DKIM
Unknown (no known selector). DKIM use requires a known selector or message to assess; a published key alone cannot confirm signing, and no key at the probed common selectors proves nothing.
MTA-STS (_mta-sts.docusign.com)
Not checked
TLS-RPT (_smtp._tls.docusign.com)
Not checked

Interpretation

  • p=reject: receivers are asked to reject failing mail.
  • Relaxed DKIM alignment (default).
  • Relaxed SPF alignment (default).
  • -all: unlisted hosts fail SPF.
  • 2 DNS-querying terms (include, a, mx, ptr, exists, redirect), counted recursively; the limit is 10.
  • Checked with an earlier assessment that did not validate IP mechanism syntax or resolve a/mx/exists targets; it is re-assessed on the next check.

Observations

  • SPF: docusign.com: include:%{ir}.%{v}.%{d}.spf.has.pphosted.com uses a macro; not expanded

DMARC discovery (RFC 9989 tree walk)

  1. _dmarc.docusign.com: ok, 1 DMARC record

Recent checks

  • 2026-10-18 22:03 UTC: DMARC reject; SPF -all

Assessment posture-v1. DNS lookup failures leave the policy unknown.

docusign.net
subsidiaryReviewed 2026-10-18
DomainSpoof directory (seed)rejectDirect-all · 1/10 lookupsAggregate reports requested (rua)Not checkedUnknown (no known selector)
Not checkedNot checked
2026-10-18 22:03 UTC
Records and check details

Published records

DMARC (_dmarc.docusign.net)
v=DMARC1; p=reject; sp=reject; rua=mailto:…@emaildefense.proofpoint.com; ruf=mailto:…@emaildefense.proofpoint.com; rf=afrf; fo=1;
SPF (docusign.net)
v=spf1 include:%{ir}.%{v}.%{d}.spf.has.pphosted.com -all
MX (docusign.net)
Not checked
DKIM
Unknown (no known selector). DKIM use requires a known selector or message to assess; a published key alone cannot confirm signing, and no key at the probed common selectors proves nothing.
MTA-STS (_mta-sts.docusign.net)
Not checked
TLS-RPT (_smtp._tls.docusign.net)
Not checked

Interpretation

  • p=reject: receivers are asked to reject failing mail.
  • Relaxed DKIM alignment (default).
  • Relaxed SPF alignment (default).
  • rf is a legacy tag removed by RFC 9989.
  • -all: unlisted hosts fail SPF.
  • 1 DNS-querying term (include, a, mx, ptr, exists, redirect), counted recursively; the limit is 10.
  • Checked with an earlier assessment that did not validate IP mechanism syntax or resolve a/mx/exists targets; it is re-assessed on the next check.

Observations

  • SPF: docusign.net: include:%{ir}.%{v}.%{d}.spf.has.pphosted.com uses a macro; not expanded

DMARC discovery (RFC 9989 tree walk)

  1. _dmarc.docusign.net: ok, 1 DMARC record

Recent checks

  • 2026-10-18 22:03 UTC: DMARC reject; SPF -all

Assessment posture-v1. DNS lookup failures leave the policy unknown.

“Not checked”: no check yet (mail, DKIM and MTA-STS facts were added later, so older checks show “Not checked” for them). “Lookup failed”: DNS result unknown. DKIM is probed at a fixed list of common selectors only. Report mailbox names are redacted.

Reports on official domains appear under “Official assets with reports” on the Reported matches tab.