public company · US

Robinhood

Robinhood Markets, Inc.

Primary official domain
robinhood.com
Reviewed official domains
1 (directory review; organization has not verified)
Directory source
BreachScout directory · Suggest a correction
Matching domains, 30 days
50
registrable domains containing the brand; source date or last feed observation
First source-reported, 30 days
0
domains first source-reported within 30 days
First observed, 30 days
53
domains first observed by DomainSpoof in feeds
Email policy (primary domain)
DMARC quarantine
SPF Over lookup limit (18 of 10) · Mail: Receives mail (5 MX hosts) · checked 2026-10-19 · published policy

What we watch for

Hostnames in phishing feeds and certificate logs are matched on these brand tokens; feed target labels are matched on the aliases. Generated spellings (typos, lure words, look-alike characters, other top-level domains) are derived from the official domains and tokens and checked against feeds, certificate logs and DNS.

Brand tokens
robinhood
Label aliases
Robinhood
Official domains
robinhood.com (all)
Generated spellings
120 tracked · 70 observed somewhere · 50 not observed (all)
Can receive mail
32 spellings and 9 reported domains publish MX records · mail at Above.com parking (parking placeholder) 12 · h-email.net (parking placeholder) 6 · hostedmxserver.com 4 · 14 more (70 spellings and 50 reported domains of the last 30 days checked; MX shows the domain can receive mail, not who operates it)

Official domains and email policies

Domains reviewed as belonging to Robinhood. DMARC helps receivers check the From domain; lookalike domains remain possible. Published policies cannot confirm actual mail configuration or receiver behavior.

DomainRelationshipEvidenceDMARC policyPolicy sourceSPFReportingMailDKIMMTA-STSLast check
robinhood.com
primaryReviewed —
Portfolio directory (wikidata_cik+financedb_ticker)quarantineDirectOver lookup limit (18 of 10)Aggregate reports requested (rua)Receives mail (5 MX hosts)Key published (google, s1, s2 +4)
No MTA-STSNo TLS-RPT
2026-10-19 09:41 UTC
Records and check details

Published records

DMARC (_dmarc.robinhood.com)
v=DMARC1; p=quarantine; rua=mailto:…@robinhood.com; ruf=mailto:…@robinhood.com; fo=0; adkim=r; aspf=r; rf=afrf
SPF (robinhood.com)
v=spf1 ip4:152.70.150.118 a:outbound.email.robinhood.com include:mail.zendesk.com include:amazonses.com include:_spf.google.com include:spf.mandrillapp.com include:mg-spf.greenhouse.io include:aristotle.com exists:%{i}._spf.mta.salesforce.com ~all
MX (robinhood.com)
1 aspmx.l.google.com · 5 alt1.aspmx.l.google.com · 5 alt2.aspmx.l.google.com · 10 aspmx2.googlemail.com · 10 aspmx3.googlemail.com
DKIM
Key published (google, s1, s2 +4) (google: rsa, s1: rsa, s2: rsa, mandrill: rsa, zendesk1: rsa, zendesk2: rsa, m1: rsa). DKIM use requires a known selector or message to assess; a published key alone cannot confirm signing, and no key at the probed common selectors proves nothing.
MTA-STS (_mta-sts.robinhood.com)
No MTA-STS
TLS-RPT (_smtp._tls.robinhood.com)
No TLS-RPT

Interpretation

  • p=quarantine: receivers are asked to treat failing mail as suspicious.
  • Relaxed DKIM alignment (default).
  • Relaxed SPF alignment (default).
  • rf is a legacy tag removed by RFC 9989.
  • ~all (softfail): unlisted hosts are marked suspicious; this is not +all and does not by itself bypass DMARC.
  • 18 DNS-querying terms (include, a, mx, ptr, exists, redirect), counted recursively; the limit is 10.
  • Receives mail (5 MX hosts).
  • DKIM key record published at google (rsa), s1 (rsa), s2 (rsa), mandrill (rsa), zendesk1 (rsa), zendesk2 (rsa), m1 (rsa). A published key does not show that mail is signed.
  • No MTA-STS record (_mta-sts TXT).
  • No TLS-RPT record: no address for SMTP TLS failure reports, a visibility gap rather than an enforcement setting.

Observations

  • SPF (sender-specific): _spf.salesforce.com: exists:%{i}._spf.mta.salesforce.com uses a sender-dependent macro
  • SPF (sender-specific): robinhood.com: exists:%{i}._spf.mta.salesforce.com uses a sender-dependent macro
  • SPF: 18 DNS-querying terms exceed the limit of 10 (permerror)

DMARC discovery (RFC 9989 tree walk)

  1. _dmarc.robinhood.com: ok, 1 DMARC record

Recent checks

  • 2026-10-19 09:41 UTC: DMARC quarantine; SPF too many lookups; 5 MX hosts; no MTA-STS
  • 2026-10-18 22:03 UTC: DMARC quarantine; SPF too many lookups

Assessment posture-v3. DNS lookup failures leave the policy unknown.

“Not checked”: no check yet (mail, DKIM and MTA-STS facts were added later, so older checks show “Not checked” for them). “Lookup failed”: DNS result unknown. DKIM is probed at a fixed list of common selectors only. Report mailbox names are redacted.

Reports on official domains appear under “Official assets with reports” on the Reported matches tab.