public company · US

Meta (Facebook)

Meta Platforms, Inc.

Facebook, Instagram and WhatsApp.

Primary official domain
facebook.com
Reviewed official domains
5 (directory review; organization has not verified)
Directory source
BreachScout directory · Suggest a correction
Matching domains, 30 days
152
registrable domains containing the brand; source date or last feed observation
First source-reported, 30 days
0
domains first source-reported within 30 days
First observed, 30 days
174
domains first observed by DomainSpoof in feeds
Email policy (primary domain)
DMARC reject
SPF -all · 1/10 lookups · Mail: Not checked · checked 2026-10-18 · published policy

What we watch for

Hostnames in phishing feeds and certificate logs are matched on these brand tokens; feed target labels are matched on the aliases. Generated spellings (typos, lure words, look-alike characters, other top-level domains) are derived from the official domains and tokens and checked against feeds, certificate logs and DNS.

Brand tokens
facebookinstagrammetaplatformswhatsapp
Label aliases
Facebook · Instagram · Meta Platforms · WhatsApp · Meta
Official domains
meta.com · facebook.com · fb.com · instagram.com · whatsapp.com (all)
Generated spellings
400 tracked · 8 observed somewhere · 392 not observed (all)
Can receive mail
3 spellings and 32 reported domains publish MX records · mail at Google 6 · iFastNet 4 · Cloudflare Email Routing (mail forwarding) 2 · 22 more (5 spellings and 152 reported domains of the last 30 days checked; MX shows the domain can receive mail, not who operates it)

Official domains and email policies

Domains reviewed as belonging to Meta (Facebook). DMARC helps receivers check the From domain; lookalike domains remain possible. Published policies cannot confirm actual mail configuration or receiver behavior.

DomainRelationshipEvidenceDMARC policyPolicy sourceSPFReportingMailDKIMMTA-STSLast check
meta.com
primaryReviewed —
Portfolio directory (wikidata_cik)rejectDirect-all · 5/10 lookupsAggregate reports requested (rua)Receives mail (4 MX hosts)Unknown (no key at common selectors)
No MTA-STSNo TLS-RPT
2026-10-19 10:41 UTC
Records and check details

Published records

DMARC (_dmarc.meta.com)
v=DMARC1; p=reject; pct=100; rua=mailto:…@dmarc.facebookmail.com
SPF (meta.com)
v=spf1 redirect=_spf.fb.com
MX (meta.com)
10 mxa-00082601.gslb.pphosted.com · 10 mxb-00082601.gslb.pphosted.com · 20 mx0a-00082601.pphosted.com · 20 mx0b-00082601.pphosted.com
DKIM
Unknown (no key at common selectors). DKIM use requires a known selector or message to assess; a published key alone cannot confirm signing, and no key at the probed common selectors proves nothing.
MTA-STS (_mta-sts.meta.com)
No MTA-STS
TLS-RPT (_smtp._tls.meta.com)
No TLS-RPT

Interpretation

  • p=reject: receivers are asked to reject failing mail.
  • Relaxed DKIM alignment (default).
  • Relaxed SPF alignment (default).
  • pct=100 is a legacy tag removed by RFC 9989; its effect is receiver-dependent.
  • -all: unlisted hosts fail SPF.
  • 5 DNS-querying terms (include, a, mx, ptr, exists, redirect), counted recursively; the limit is 10.
  • Static check of the published record: syntax, every referenced include/redirect record, the DNS-lookup count and a/mx/exists targets (resolved to count void lookups). It does not evaluate SPF for any particular sending host.
  • Receives mail (4 MX hosts).
  • No usable DKIM key at the 28 common selectors probed. DKIM may use other selectors, so this proves nothing about DKIM use.
  • No MTA-STS record (_mta-sts TXT).
  • No TLS-RPT record: no address for SMTP TLS failure reports, a visibility gap rather than an enforcement setting.

Observations

  • Reporting: external destination dmarc.facebookmail.com does not publish report authorization; this affects reporting, not enforcement.

DMARC discovery (RFC 9989 tree walk)

  1. _dmarc.meta.com: ok, 1 DMARC record

Recent checks

  • 2026-10-19 10:41 UTC: DMARC reject; SPF -all; 4 MX hosts; no MTA-STS
  • 2026-10-18 22:03 UTC: DMARC reject; SPF -all

Assessment posture-v3. DNS lookup failures leave the policy unknown.

facebook.com
primaryReviewed 2026-10-18
DomainSpoof directory (seed)rejectDirect-all · 1/10 lookupsAggregate reports requested (rua)Not checkedUnknown (no known selector)
Not checkedNot checked
2026-10-18 22:03 UTC
Records and check details

Published records

DMARC (_dmarc.facebook.com)
v=DMARC1; p=reject; rua=mailto:…@dmarc.facebookmail.com; pct=100
SPF (facebook.com)
v=spf1 redirect=_spf.facebook.com
MX (facebook.com)
Not checked
DKIM
Unknown (no known selector). DKIM use requires a known selector or message to assess; a published key alone cannot confirm signing, and no key at the probed common selectors proves nothing.
MTA-STS (_mta-sts.facebook.com)
Not checked
TLS-RPT (_smtp._tls.facebook.com)
Not checked

Interpretation

  • p=reject: receivers are asked to reject failing mail.
  • Relaxed DKIM alignment (default).
  • Relaxed SPF alignment (default).
  • pct=100 is a legacy tag removed by RFC 9989; its effect is receiver-dependent.
  • -all: unlisted hosts fail SPF.
  • 1 DNS-querying term (include, a, mx, ptr, exists, redirect), counted recursively; the limit is 10.
  • Checked with an earlier assessment that did not validate IP mechanism syntax or resolve a/mx/exists targets; it is re-assessed on the next check.

Observations

  • Reporting: external destination dmarc.facebookmail.com does not publish report authorization; this affects reporting, not enforcement.

DMARC discovery (RFC 9989 tree walk)

  1. _dmarc.facebook.com: ok, 1 DMARC record

Recent checks

  • 2026-10-18 22:03 UTC: DMARC reject; SPF -all

Assessment posture-v1. DNS lookup failures leave the policy unknown.

fb.com
subsidiaryReviewed 2026-10-18
DomainSpoof directory (seed)rejectDirect-all · 5/10 lookupsAggregate reports requested (rua)Not checkedUnknown (no known selector)
Not checkedNot checked
2026-10-18 22:03 UTC
Records and check details

Published records

DMARC (_dmarc.fb.com)
v=DMARC1; p=reject; pct=100; rua=mailto:…@dmarc.facebookmail.com
SPF (fb.com)
v=spf1 redirect=_spf.fb.com
MX (fb.com)
Not checked
DKIM
Unknown (no known selector). DKIM use requires a known selector or message to assess; a published key alone cannot confirm signing, and no key at the probed common selectors proves nothing.
MTA-STS (_mta-sts.fb.com)
Not checked
TLS-RPT (_smtp._tls.fb.com)
Not checked

Interpretation

  • p=reject: receivers are asked to reject failing mail.
  • Relaxed DKIM alignment (default).
  • Relaxed SPF alignment (default).
  • pct=100 is a legacy tag removed by RFC 9989; its effect is receiver-dependent.
  • -all: unlisted hosts fail SPF.
  • 5 DNS-querying terms (include, a, mx, ptr, exists, redirect), counted recursively; the limit is 10.
  • Checked with an earlier assessment that did not validate IP mechanism syntax or resolve a/mx/exists targets; it is re-assessed on the next check.

Observations

  • Reporting: external destination dmarc.facebookmail.com does not publish report authorization; this affects reporting, not enforcement.

DMARC discovery (RFC 9989 tree walk)

  1. _dmarc.fb.com: ok, 1 DMARC record

Recent checks

  • 2026-10-18 22:03 UTC: DMARC reject; SPF -all

Assessment posture-v1. DNS lookup failures leave the policy unknown.

instagram.com
subsidiaryReviewed 2026-10-18
DomainSpoof directory (seed)rejectDirect-all · 6/10 lookupsAggregate reports requested (rua)Not checkedUnknown (no known selector)
Not checkedNot checked
2026-10-18 22:03 UTC
Records and check details

Published records

DMARC (_dmarc.instagram.com)
v=DMARC1; p=reject; rua=mailto:…@dmarc.facebookmail.com; pct=100
SPF (instagram.com)
v=spf1 include:facebookmail.com include:_spf.fb.com -all
MX (instagram.com)
Not checked
DKIM
Unknown (no known selector). DKIM use requires a known selector or message to assess; a published key alone cannot confirm signing, and no key at the probed common selectors proves nothing.
MTA-STS (_mta-sts.instagram.com)
Not checked
TLS-RPT (_smtp._tls.instagram.com)
Not checked

Interpretation

  • p=reject: receivers are asked to reject failing mail.
  • Relaxed DKIM alignment (default).
  • Relaxed SPF alignment (default).
  • pct=100 is a legacy tag removed by RFC 9989; its effect is receiver-dependent.
  • -all: unlisted hosts fail SPF.
  • 6 DNS-querying terms (include, a, mx, ptr, exists, redirect), counted recursively; the limit is 10.
  • Checked with an earlier assessment that did not validate IP mechanism syntax or resolve a/mx/exists targets; it is re-assessed on the next check.

Observations

  • Reporting: external destination dmarc.facebookmail.com does not publish report authorization; this affects reporting, not enforcement.

DMARC discovery (RFC 9989 tree walk)

  1. _dmarc.instagram.com: ok, 1 DMARC record

Recent checks

  • 2026-10-18 22:03 UTC: DMARC reject; SPF -all

Assessment posture-v1. DNS lookup failures leave the policy unknown.

whatsapp.com
subsidiaryReviewed 2026-10-18
DomainSpoof directory (seed)rejectDirect-all · 6/10 lookupsAggregate reports requested (rua)Not checkedUnknown (no known selector)
Not checkedNot checked
2026-10-18 22:03 UTC
Records and check details

Published records

DMARC (_dmarc.whatsapp.com)
v=DMARC1; p=reject; rua=mailto:…@dmarc.facebookmail.com; pct=100
SPF (whatsapp.com)
v=spf1 include:_spf.fb.com include:facebookmail.com -all
MX (whatsapp.com)
Not checked
DKIM
Unknown (no known selector). DKIM use requires a known selector or message to assess; a published key alone cannot confirm signing, and no key at the probed common selectors proves nothing.
MTA-STS (_mta-sts.whatsapp.com)
Not checked
TLS-RPT (_smtp._tls.whatsapp.com)
Not checked

Interpretation

  • p=reject: receivers are asked to reject failing mail.
  • Relaxed DKIM alignment (default).
  • Relaxed SPF alignment (default).
  • pct=100 is a legacy tag removed by RFC 9989; its effect is receiver-dependent.
  • -all: unlisted hosts fail SPF.
  • 6 DNS-querying terms (include, a, mx, ptr, exists, redirect), counted recursively; the limit is 10.
  • Checked with an earlier assessment that did not validate IP mechanism syntax or resolve a/mx/exists targets; it is re-assessed on the next check.

Observations

  • Reporting: external destination dmarc.facebookmail.com does not publish report authorization; this affects reporting, not enforcement.

DMARC discovery (RFC 9989 tree walk)

  1. _dmarc.whatsapp.com: ok, 1 DMARC record

Recent checks

  • 2026-10-18 22:03 UTC: DMARC reject; SPF -all

Assessment posture-v1. DNS lookup failures leave the policy unknown.

“Not checked”: no check yet (mail, DKIM and MTA-STS facts were added later, so older checks show “Not checked” for them). “Lookup failed”: DNS result unknown. DKIM is probed at a fixed list of common selectors only. Report mailbox names are redacted.

Reports on official domains appear under “Official assets with reports” on the Reported matches tab.