← Interactive report

facebook.com

warnScanned ·
Summary

facebook.com has warnings

0To fix now
2Recommended
4Healthy

DNS & email auth

warnLast checked
Findings4 findings

Recommended (1)

  • DKIM selector default publishes an empty revoked key.

    DKIM

    default (default._domainkey.facebook.com)

    How to fix

    Remove the record if the key is retired, or re-publish the public key if the selector is still in use.

Healthy (3)

  • 1 MX record found.

    MX

  • SPF record is valid, using 1 of 10 DNS lookups.

    SPF

  • DMARC policy is enforced with p=reject.

    DMARC

Evidence

MX

1 record
  • smtpin.vvv.facebook.compriority 10

SPF

1 of 10 lookups
DNS lookups1 / 10
facebook.com
v=spf1 redirect=_spf.facebook.com
redirect:_spf.facebook.com
v=spf1 ip4:66.220.144.128/25 ip4:66.220.155.0/24 ip4:66.220.157.0/25 ip4:69.63.178.128/25 ip4:69.63.181.0/24 ip4:69.63.184.0/25 ip4:69.171.232.0/24 ip4:69.171.244.0/23 -all

Root TXT

6 records
  • google-site-verification=sK6uY9x7eaMoEMfn3OILqwTFYgaNp4llmguKI-C3_iA
  • zoom-domain-verification=4b2ef4e1-6dee-4483-9869-9bef353fd147
  • facebook-domain-verification=y7isfmi3kzyg1r4wophh9vyb6pgbda
  • google-site-verification=wdH5DTJTc9AYNwVunSVFeK0hYDGUIEOGb-RReU6pJlY
  • v=spf1 redirect=_spf.facebook.com
  • google-site-verification=A2WZWCNQHrGV_TWwKh6KHY90tY0SHZo_RnyMJoDaG0s

DKIM selectors

1 record
  • defaultdefault._domainkey.facebook.com
    • t=y; k=rsa; p=;

Probed with no records: selector1, selector2, google, 20230601, 20210112, k1, k2, s1, s2, dkim, mail

DMARC

1 record
v=DMARC1; p=reject; rua=mailto:a@dmarc.facebookmail.com; ruf=mailto:fb-dmarc@datafeeds.phishlabs.com; pct=100
v=DMARC1
Identifies this TXT record as a DMARC policy. Must be the first tag.
p=reject
Receivers refuse mail that fails DMARC outright.
rua=mailto:a@dmarc.facebookmail.com
Receivers send daily aggregate reports about passing and failing mail to a@dmarc.facebookmail.com.
ruf=mailto:fb-dmarc@datafeeds.phishlabs.com
Receivers may send per-message failure reports to fb-dmarc@datafeeds.phishlabs.com. Many receivers skip these for privacy reasons.
pct=100
The policy applies to all failing mail.
sp=rejectdefault
No sp= tag is published, so subdomains inherit the domain's p= policy.
adkim=rdefault
No adkim= tag is published, so DKIM alignment is relaxed: any subdomain of the From domain may sign.
aspf=rdefault
No aspf= tag is published, so SPF alignment is relaxed: the envelope sender may be any subdomain of the From domain.
Raw JSON
{
  "mx": [
    {
      "type": "MX",
      "exchange": "smtpin.vvv.facebook.com",
      "priority": 10
    }
  ],
  "spf": {
    "tree": {
      "via": "root",
      "domain": "facebook.com",
      "issues": [],
      "records": [
        "v=spf1 redirect=_spf.facebook.com"
      ],
      "children": [
        {
          "via": "redirect",
          "domain": "_spf.facebook.com",
          "issues": [],
          "records": [
            "v=spf1 ip4:66.220.144.128/25 ip4:66.220.155.0/24 ip4:66.220.157.0/25 ip4:69.63.178.128/25 ip4:69.63.181.0/24 ip4:69.63.184.0/25 ip4:69.171.232.0/24 ip4:69.171.244.0/23 -all"
          ],
          "children": []
        }
      ]
    },
    "truncated": false,
    "lookupCount": 1,
    "voidLookupCount": 0
  },
  "dkim": [
    {
      "cname": [],
      "records": [],
      "selector": "selector1",
      "queryName": "selector1._domainkey.facebook.com"
    },
    {
      "cname": [],
      "records": [],
      "selector": "selector2",
      "queryName": "selector2._domainkey.facebook.com"
    },
    {
      "cname": [],
      "records": [],
      "selector": "google",
      "queryName": "google._domainkey.facebook.com"
    },
    {
      "cname": [],
      "records": [],
      "selector": "20230601",
      "queryName": "20230601._domainkey.facebook.com"
    },
    {
      "cname": [],
      "records": [],
      "selector": "20210112",
      "queryName": "20210112._domainkey.facebook.com"
    },
    {
      "cname": [],
      "records": [],
      "selector": "k1",
      "queryName": "k1._domainkey.facebook.com"
    },
    {
      "cname": [],
      "records": [],
      "selector": "k2",
      "queryName": "k2._domainkey.facebook.com"
    },
    {
      "cname": [],
      "records": [],
      "selector": "s1",
      "queryName": "s1._domainkey.facebook.com"
    },
    {
      "cname": [],
      "records": [],
      "selector": "s2",
      "queryName": "s2._domainkey.facebook.com"
    },
    {
      "cname": [],
      "records": [
        "t=y; k=rsa; p=;"
      ],
      "selector": "default",
      "queryName": "default._domainkey.facebook.com"
    },
    {
      "cname": [],
      "records": [],
      "selector": "dkim",
      "queryName": "dkim._domainkey.facebook.com"
    },
    {
      "cname": [],
      "records": [],
      "selector": "mail",
      "queryName": "mail._domainkey.facebook.com"
    }
  ],
  "rootTxt": [
    "google-site-verification=sK6uY9x7eaMoEMfn3OILqwTFYgaNp4llmguKI-C3_iA",
    "zoom-domain-verification=4b2ef4e1-6dee-4483-9869-9bef353fd147",
    "facebook-domain-verification=y7isfmi3kzyg1r4wophh9vyb6pgbda",
    "google-site-verification=wdH5DTJTc9AYNwVunSVFeK0hYDGUIEOGb-RReU6pJlY",
    "v=spf1 redirect=_spf.facebook.com",
    "google-site-verification=A2WZWCNQHrGV_TWwKh6KHY90tY0SHZo_RnyMJoDaG0s"
  ],
  "dmarcTxt": [
    "v=DMARC1; p=reject; rua=mailto:a@dmarc.facebookmail.com; ruf=mailto:fb-dmarc@datafeeds.phishlabs.com; pct=100"
  ]
}

SSL & domain expiry

warnLast checked
Findings2 findings

Recommended (1)

  • The TLS certificate expires in 7 days (Sep 13, 2026).

    TLS certificate

    How to fix

    Renew the certificate before it expires and confirm auto-renewal is working.

Healthy (1)

  • Registration expiry is not published for this domain.

    Domain expiry

    The registry does not expose expiry data over RDAP.

Evidence

TLS certificate

port 443
Issued to
*.facebook.com
Issued by
DigiCert Inc
Valid from
Valid until
Days remaining
7 days
Verification
trusted

Registration

unpublished

The registry does not expose expiry data over RDAP.

Raw JSON
{
  "tls": {
    "ok": true,
    "issuer": "DigiCert Inc",
    "subject": "*.facebook.com",
    "validTo": "2026-09-13T23:59:59.000Z",
    "validFrom": "2026-06-15T00:00:00.000Z",
    "authorized": true,
    "authorizationError": null
  },
  "domainExpiry": {
    "known": false
  },
  "registration": null
}

Generated by Internet Posture · internetposture.com