Dataweaz

splunk.com

Summary

Registrar
MarkMonitor Inc.
Status
clientDeleteProhibited
Created on
December 7, 2001
Expires on
December 7, 2026
Name servers
ha1.markmonitor.zone, ha3.markmonitor.zone, ha4.markmonitor.zone, ha2.markmonitor.zone
Mail servers
alln-mx-01.cisco.com, rcdn-mx-01.cisco.com, aer-mx-01.cisco.com
DMARC
Reject
SPF
Soft

Spoofing protection (DMARC)

Reject

E-mails spoofing this domain are rejected.

DMARC tells mail servers what to do with an e-mail that claims to come from splunk.com but fails SPF and DKIM checks.

Policy
Reject
Subdomain policy
Reject
Messages covered
100%
DKIM alignment
Relaxed
SPF alignment
Relaxed
Aggregate reports
[email protected]
Failure reports
—

Record

v=DMARC1; p=reject; sp=reject; rua=mailto:[email protected]

Authorized senders (SPF)

Soft

E-mails sent by any other server are accepted but flagged as suspicious.

SPF lists the servers allowed to send e-mails for splunk.com.

RuleValueResult
ip4104.143.85.100Allowed
ip4104.193.137.209Allowed
ip4104.193.137.4Allowed
ip4104.193.137.41Allowed
ip4192.41.71.17Allowed
ip4199.119.121.165Allowed
ip4204.107.141.23Allowed
ip4204.107.141.240Allowed
ip4216.24.147.140Allowed
ip468.232.128.201Allowed
ip468.232.147.33Allowed
ip468.232.149.37Allowed
ip497.107.118.214Allowed
ip450.57.196.251Allowed
ip4162.242.190.82Allowed
ip472.3.137.171Allowed
ip492.52.102.162Allowed
ip463.236.27.141Allowed
ip467.202.198.229Allowed
ip463.241.4.85Allowed
ip467.202.198.237Allowed
ip45.61.117.0/24Allowed
ip4174.143.181.180Allowed
includesendgrid.netAllowed
includemktomail.comAllowed
include_spf.salesforce.comAllowed
includeamazonses.comAllowed
includeus.khoros-mail.comAllowed
includeeu.khoros-mail.comAllowed
include_spf.qualtrics.comAllowed
include_netblocks.xactlycorp.comAllowed
all—Suspicious

Top-level DNS lookups: 8 of 10 allowed

Record

v=spf1 ip4:104.143.85.100 ip4:104.193.137.209 ip4:104.193.137.4 ip4:104.193.137.41 ip4:192.41.71.17 ip4:199.119.121.165 ip4:204.107.141.23 ip4:204.107.141.240 ip4:216.24.147.140 ip4:68.232.128.201 ip4:68.232.147.33 ip4:68.232.149.37 ip4:97.107.118.214 ip4:50.57.196.251 ip4:162.242.190.82 ip4:72.3.137.171 ip4:92.52.102.162 ip4:63.236.27.141 ip4:67.202.198.229 ip4:63.241.4.85 ip4:67.202.198.237 ip4:5.61.117.0/24 ip4:174.143.181.180 include:sendgrid.net include:mktomail.com include:_spf.salesforce.com include:amazonses.com include:us.khoros-mail.com include:eu.khoros-mail.com include:_spf.qualtrics.com include:_netblocks.xactlycorp.com ~all

E-mail signing (DKIM)

DKIM keys published by splunk.com under the most common selectors. Other keys may exist under selectors specific to each sending service.

SelectorLikely serviceKeyStatus
mandrillMandrillRSA 1024 bits · shortActive
s1SendGridRSA 2048 bitsActive
s2SendGridRSA 1024 bits · shortActive

RSA keys shorter than 2048 bits, called short keys, are discouraged: they are easier to break.

MX, SPF, DKIM and DMARC: the e-mail records

Four DNS records make a domain's e-mail work. MX says where e-mails sent to splunk.com arrive; SPF, DKIM and DMARC let mail servers check that an e-mail claiming to come from splunk.com was really sent by this domain, which protects it against spoofing.

MX

An MX (Mail Exchanger) record designates a server that receives e-mails sent to the domain. When someone writes to an @splunk.com address, their mail server queries the DNS for the domain's MX records, then delivers the message to the server they point to.

Example record

splunk.com  MX  10 mx1.splunk.com.
splunk.com  MX  20 mx2.splunk.com.

What the record contains

10, 20
Priority: the server with the lowest number is tried first. Servers with equal priority share the load.
mx1.splunk.com.
Host name of the mail server. It must point to an A or AAAA record: an IP address or an alias (CNAME) is not allowed here.
0 .
An MX "0 .", called a null MX, declares that the domain accepts no e-mail: sending servers give up at once instead of retrying.

Declaring at least two servers with different priorities avoids losing e-mails during an outage: sending servers retry for several days and fall back on the backup server. Without any MX, they try to deliver directly to the IP address of the domain.

SPF

SPF (Sender Policy Framework) is a TXT record listing the servers allowed to send e-mails on behalf of the domain. The receiving server checks that the sender is on this list. The final "all" rule says what to do with other servers: reject them (-all), flag their e-mails as suspicious (~all) or make no decision (?all).

Example record

splunk.com  TXT  "v=spf1 mx include:_spf.google.com ip4:192.0.2.10 -all"

What the record contains

v=spf1
Identifies the record as an SPF policy. It must come first.
ip4, ip6
Allows a specific IP address or an address range, for example ip4:192.0.2.0/24.
a, mx
Allows the addresses of the domain itself (A record) or those of its mail servers (MX).
include
Allows the servers of another domain, usually a sending service: include:_spf.google.com for Google Workspace.
-all, ~all
Final rule, applied to every other server. Its qualifier decides what happens to them: - rejects them, ~ flags their e-mails as suspicious, ? makes no decision, + accepts them (avoid it).

A domain must publish only one SPF record, and its evaluation cannot exceed 10 DNS lookups (include, a, mx, exists, redirect). Beyond that, mail servers treat it as invalid.

DKIM

DKIM (DomainKeys Identified Mail) signs every outgoing e-mail with a private key. The matching public key is published in a TXT record at selector._domainkey.splunk.com, so the recipient can check that the message really comes from the domain and was not altered on the way. The selector is chosen by each sending service and cannot be guessed: Dataweaz checks the most common ones (Google Workspace, Microsoft 365, Mailchimp, SendGrid…), so a key published under another selector may exist without appearing here.

Example record

google._domainkey.splunk.com  TXT  "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA…"

What the record contains

v=DKIM1
Protocol version. Optional but recommended, in which case it must come first.
k
Key algorithm: rsa, the most common, or ed25519.
p
Public key, base64-encoded. An empty value means the key has been revoked.
t
Flags: y marks a key in testing, whose failures must not be penalized; s forbids its use for subdomains.

Each sending service publishes its key under its own selector (google, selector1, k1…), which allows several keys and seamless rotation. A 2048-bit RSA key is recommended today.

DMARC

DMARC (Domain-based Message Authentication, Reporting and Conformance) builds on SPF and DKIM. Published on _dmarc.splunk.com, it tells mail servers what to do with an e-mail that fails these checks (let it through, send it to spam or reject it) and where to send reports.

Example record

_dmarc.splunk.com  TXT  "v=DMARC1; p=quarantine; rua=mailto:[email protected]; adkim=r; aspf=r"

What the record contains

v=DMARC1
Identifies the record as a DMARC policy. It must come first.
p
Policy applied to e-mails that fail the checks: none (monitoring only), quarantine (spam folder) or reject.
sp
Subdomain policy. Without it, subdomains follow the domain's policy.
rua
Address that receives daily aggregate reports about e-mails sent on behalf of the domain, whether they pass the checks or not.
ruf
Address that receives detailed failure reports, message by message. Few providers still send them.
pct
Percentage of e-mails subject to the policy, for a gradual rollout. 100 by default.
adkim, aspf
DKIM and SPF alignment: r (relaxed, a subdomain of the same domain is enough) or s (strict, the domain must be identical).

To roll out DMARC without blocking legitimate e-mails, start with p=none and an rua address, analyze the reports to find every service sending on behalf of the domain, then move to quarantine and finally to reject.

DNS records of splunk.com

IP addresses (A and AAAA)

An A record maps the domain name to an IPv4 address: the address of the server that browsers contact to display the website. The AAAA record does the same for an IPv6 address. A domain can have several of them to spread visits across several servers.

TypeIP address
A204.107.141.165

Name servers (NS)

NS records designate the authoritative DNS servers of the domain: they answer every question about its other records (A, MX, TXT…). They are provided by the registrar, the hosting provider or a dedicated DNS service, and several servers are declared so that the domain keeps working if one of them fails.

ServerIP address
ha1.markmonitor.zone192.174.68.5
ha3.markmonitor.zone176.97.158.5
ha4.markmonitor.zone162.219.55.170
ha2.markmonitor.zone162.219.54.170

Mail servers (MX)

MX records point to the servers that receive e-mails sent to the domain, that is to @splunk.com addresses. Each server has a priority: the one with the lowest number is tried first, the others take over if it fails. Without an MX record, the domain cannot receive e-mails.

PriorityServerIP address
10alln-mx-01.cisco.com173.37.147.230
20rcdn-mx-01.cisco.com72.163.7.166
30aer-mx-01.cisco.com173.38.212.150

TXT records

TXT records hold free text. They are used to prove ownership of the domain to online services (Google, Microsoft, Facebook…) and to publish e-mail security rules: SPF on the domain itself, DMARC on _dmarc.splunk.com.

NameContent
splunk.comibmid=83a3b96b-462b-48e7-84de-ed329931a527
splunk.comOSSRH-63641
splunk.comgoogle-site-verification=5z5kd_tSCmv7601KeLysRBejSSt9aTG9OvvoDwQLhKA
splunk.cominfoblox-domain-mastery=09352511075601a5ceb8a60b200af371bd04c3074a166196e30e595910e37f4413
splunk.comadobe-idp-site-verification=fef37ebe9a615499c4c118b9067b75e22c2677bcdaab6f4208a6801de5eec1a9
splunk.comh1-domain-verification=BXKJaqK8hG8nzVRuvyanaE589qdYxNexQHS3sdu2VdyLQJ4M
splunk.comstripe-verification=8c4e3a2d5ffa2b270e1fdc8ebf4aa6f7468f148379de20e91c240b8977cea525
splunk.comgoogle-site-verification=koV16EDfXZYg4ojRfGe1LBx-6IpP_4Z5707gm7xCi9s
splunk.comlHdmUyf+vS8AnQMQ+ihAFkim1+8bFXLG6Z8yLrp6iRk=
splunk.comMS=ms91767858
splunk.comstripe-verification=481d5b84574d90c52885c46bab513a70630ed7e6e782205ff8663c1ecb85a303
splunk.comv=DKIM1; h=sha256; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDn7EiK3r/vRRde/oD9XAsACz44UTrt2j+hGKdqQ093/QBbPZS99TKxBkcKeWEnu+TzV+WigS8eD424pZVNP2Y4Ta5qbWdtJa+jtoc9953m7WOkTYMM4/iiDxPzhg2yxWdxu3VvuyiZBLhPXzX54mj8rXaTyXXWry2+CRQqDds9pwIDAQAB; t=s
splunk.comstripe-verification=9eee1ee0eb0c51ae7fd5e7c4ea9c1c92b39bccf4b15ecb5a754a62e3755e6e84
splunk.comt3m0gtrwmxl0924m6b5pxz3xl8f0lvqd
splunk.comatlassian-domain-verification=Gt2demeKDLmtNc9kPZhaAHFA37DEIcmFGUd6LARvB4yjLG70s3WZhaJJ15y499sb
splunk.comSNs1BkNAAXxinVFhWFKkH0CAI/oo2dp+c4m3BI8JelY=
splunk.comgoogle-site-verification=RcDQNsU6p153IUeSRXYQ1tm9yLNVmoPi7vtzIcsKrE0
splunk.comdocker-verification=6f04dca6-cd7b-4c28-9580-6e4f189280b3
splunk.comsmartsheet-site-validation=NHBTVyjpP5JXCGPvpdEgcX27LICV5HIZ
splunk.comdocusign=2fe6ad8d-aee9-4e42-ac2f-656b5f3cfc26
splunk.comgoogle-site-verification=jiLKirJJG8hU5Vzq2MwLVFrhYsxQFwq8XZX2w59ae5k
splunk.comtmp091923~
splunk.comversion: STSv1 mode: testing mx: mx1.splunk.iphmx.com mx: mx2.splunk.iphmx.com max_age: 604800
splunk.combox-domain-verification=cd7984e5ada8f22fb0da79c6cb98c3a33fc876e94108ef614f621797f3f2bbb5
splunk.comgoogle-site-verification=EIXbTA_oeDypBr-7T0XtF94YumbkeTjJC4LWQgZyQKc
splunk.compostman-domain-verification=f277575139b43f563844b587d4db2f1d53dbeaa2c5ce2dbe9ae2261f58df53220eb52499be5cba458e7d70a6adbae80124e8e98a0250cc92eb2868b7d74518d9
splunk.commgverify=9ca8661b7fc2d2956d46a32ecfa5cd3065555c146a6b5c6d045682d0bb4ceedb
splunk.comtmp0919231
splunk.comcisco-ci-domain-verification=32f46cabea343fb3d97ef520db6c22cd805fd9c799a8b9fdd23ac9ce669e4f0
splunk.com6ad7ce13d5db4c6a918987c7f7902eb3
splunk.comv=spf1 ip4:104.143.85.100 ip4:104.193.137.209 ip4:104.193.137.4 ip4:104.193.137.41 ip4:192.41.71.17 ip4:199.119.121.165 ip4:204.107.141.23 ip4:204.107.141.240 ip4:216.24.147.140 ip4:68.232.128.201 ip4:68.232.147.33 ip4:68.232.149.37 ip4:97.107.118.214 ip4:50.57.196.251 ip4:162.242.190.82 ip4:72.3.137.171 ip4:92.52.102.162 ip4:63.236.27.141 ip4:67.202.198.229 ip4:63.241.4.85 ip4:67.202.198.237 ip4:5.61.117.0/24 ip4:174.143.181.180 include:sendgrid.net include:mktomail.com include:_spf.salesforce.com include:amazonses.com include:us.khoros-mail.com include:eu.khoros-mail.com include:_spf.qualtrics.com include:_netblocks.xactlycorp.com ~all
splunk.comcanva-site-verification=Mp6_n_TAj8ugeRgQ2SW4tw
splunk.comSvnm3SNM1GPdjdkxa0FBrEs
splunk.comecostruxure-it-verification=57f5e8ae-c96f-4ee9-a851-9927593a2974
splunk.comstripe-verification=c32ac51bab3f3963ea40d8a4c344163c7a7a53abdf90f44f8804e03dd0be2779
splunk.comh1-domain-verification=JYgAtpxQrEaxAP1qinsyEsrC4J3eF2qGuo2GhBB5z5uv3ooY
splunk.comairtable-verification=4fa9510bf4ecbb181940d2a9157a543e
splunk.commiro-verification=53bf5ccd47cb6239fe5cf14c3b328050dd5679ac
splunk.comfastly-domain-delegation-p93t9cnsuzdyywcmowiq-00528642-2025-10-01
splunk.comstatus-page-domain-verification=jf1db9xp3drp
splunk.comgoogle-site-verification=mskVm1YX8NuIePQxcJS90umbmophJjr4ZKQ1w7LA7Z4
splunk.compendo-domain-verification=9a60eed6-9b6b-4dc7-8640-f22ec916f568
splunk.comhj-ownership=pxHY34G49Uil
splunk.comfigma-domain-verification=f1902f21ecc59a1ee389cfe91301e2788c4a480e596daa299965e8a95c30f27c-1731515654
splunk.comdocusign=595cd3cf-c1af-4f54-b7fe-061915df9e69
splunk.comv=STSv1;id=1729095894299;
splunk.comMS=ms90806461
splunk.comstripe-verification=ee72f5e801c7b56a7dc70778ad1678b8b9b1624814ff2225aa62d84e0f335b5c
splunk.comv=TLSRPTv1;rua=mailto:[email protected];
splunk.comatlassian-domain-verification=WkJkOF+ZI6vzHj9p9opUQe/iNJdVoZ1TcrcIlXCYgOs8uC4tKer+d+8HHBGOCXSh
splunk.comapple-domain-verification=RyMT3SW9OAHkDM5W
splunk.comnotion-domain-verification=xmKbvj0zTd9FQ0328THck6OS1phXfIOHGEo50fKupG8
_dmarc.splunk.comv=DMARC1; p=reject; sp=reject; rua=mailto:[email protected]
mandrill._domainkey.splunk.comv=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCrLHiExVd55zd/IQ/J/mRwSRMAocV/hMB3jXwaHH36d9NaVynQFYV8NaWi69c1veUtRzGt7yAioXqLj7Z4TeEUoOLgrKsn8YnckGs9i3B3tVFB+Ch/4mPhXWiNfNdynHWBcPcbJ8kjEQ2U8y78dHZj1YeRXXVvWob2OaKynO8/lQIDAQAB
s1._domainkey.splunk.comk=rsa; t=s; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAvVWb+Af6LeyQc5Vsgb75mXxWqTYpEqYSqjo1Br4lRS1SzFg9FlJDcy4mX3Z+da7bvOzhDoPrMg1ORRf0apiLUCXk3E3eebwctl0jkDOFtVGE0fMCL7xI2ZOfIacyyD0q0aIpX103DCRqZrFzJGs/BA57NYcnmUkMKOokgW1qlcFUclk+zB3JXAhnKqhtudcqCEHIEIo1xZ0yZTy9GIWHPa6O9OTBk8ku8bB5VWo1vDLxvxNhX3PfVZiAse13O2lUYDKQIiJxwv9n0fdGHRiDUGFLFeOaSW9CBaNHJ1q4LS+GWwadsZIo1Z72BgOtoZYUDp9Fi7vOaFncHtY2iyhV/wIDAQAB
s2._domainkey.splunk.comk=rsa; t=s; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC5n1V5iwDvpBT/C7pJyubn3HWWE+llY+AOOvBGVE5MrZjzS+RhCVbmrynDm7E/TaxMB5uYtPICij08AIq4nDq8prmEGtvF5h6hinPES2GACFIjyfmEQjhWuExlAqjMF0j5Lvgh5trCEuHYv4iKTS/cXcW/jfkpKZhOFUBsWwZXkQIDAQAB

Related IP addresses

IPv4 addresses used by splunk.com: website, name servers, mail servers and senders authorized by SPF.

IP addressUsed for/24 block
204.107.141.165Website204.107.141.0/24
192.174.68.5Name server ha1.markmonitor.zone192.174.68.0/24
176.97.158.5Name server ha3.markmonitor.zone176.97.158.0/24
162.219.55.170Name server ha4.markmonitor.zone162.219.55.0/24
162.219.54.170Name server ha2.markmonitor.zone162.219.54.0/24
173.37.147.230Mail server alln-mx-01.cisco.com173.37.147.0/24
72.163.7.166Mail server rcdn-mx-01.cisco.com72.163.7.0/24
173.38.212.150Mail server aer-mx-01.cisco.com173.38.212.0/24
104.143.85.100Authorized by SPF104.143.85.0/24
104.193.137.209Authorized by SPF104.193.137.0/24
104.193.137.4Authorized by SPF104.193.137.0/24
104.193.137.41Authorized by SPF104.193.137.0/24
192.41.71.17Authorized by SPF192.41.71.0/24
199.119.121.165Authorized by SPF199.119.121.0/24
204.107.141.23Authorized by SPF204.107.141.0/24
204.107.141.240Authorized by SPF204.107.141.0/24
216.24.147.140Authorized by SPF216.24.147.0/24
68.232.128.201Authorized by SPF68.232.128.0/24
68.232.147.33Authorized by SPF68.232.147.0/24
68.232.149.37Authorized by SPF68.232.149.0/24
97.107.118.214Authorized by SPF97.107.118.0/24
50.57.196.251Authorized by SPF50.57.196.0/24
162.242.190.82Authorized by SPF162.242.190.0/24
72.3.137.171Authorized by SPF72.3.137.0/24
92.52.102.162Authorized by SPF92.52.102.0/24
63.236.27.141Authorized by SPF63.236.27.0/24
67.202.198.229Authorized by SPF67.202.198.0/24
63.241.4.85Authorized by SPF63.241.4.0/24
67.202.198.237Authorized by SPF67.202.198.0/24
174.143.181.180Authorized by SPF174.143.181.0/24

WHOIS of the domain splunk.com

Domain Name: SPLUNK.COM
   Registry Domain ID: 80883651_DOMAIN_COM-VRSN
   Registrar WHOIS Server: whois.markmonitor.com
   Registrar URL: http://www.markmonitor.com
   Updated Date: 2025-10-03T18:01:59Z
   Creation Date: 2001-12-07T22:55:51Z
   Registry Expiry Date: 2026-12-07T22:55:51Z
   Registrar: MarkMonitor Inc.
   Registrar IANA ID: 292
   Registrar Abuse Contact Email: [email protected]
   Registrar Abuse Contact Phone: +1.2086851750
   Domain Status: clientDeleteProhibited https://icann.org/epp#clientDeleteProhibited
   Domain Status: clientTransferProhibited https://icann.org/epp#clientTransferProhibited
   Domain Status: clientUpdateProhibited https://icann.org/epp#clientUpdateProhibited
   Name Server: HA1.MARKMONITOR.ZONE
   Name Server: HA2.MARKMONITOR.ZONE
   Name Server: HA3.MARKMONITOR.ZONE
   Name Server: HA4.MARKMONITOR.ZONE
   DNSSEC: unsigned
   URL of the ICANN Whois Inaccuracy Complaint Form: https://www.icann.org/wicf/
>>> Last update of whois database: 2026-10-02T22:55:58Z <<<

For more information on Whois status codes, please visit https://icann.org/epp

NOTICE: The expiration date displayed in this record is the date the
registrar's sponsorship of the domain name registration in the registry is
currently set to expire. This date does not necessarily reflect the expiration
date of the domain name registrant's agreement with the sponsoring
registrar.  Users may consult the sponsoring registrar's Whois database to
view the registrar's reported date of expiration for this registration.

TERMS OF USE: You are not authorized to access or query our Whois
database through the use of electronic processes that are high-volume and
automated except as reasonably necessary to register domain names or
modify existing registrations; the Data in VeriSign Global Registry
Services' ("VeriSign") Whois database is provided by VeriSign for
information purposes only, and to assist persons in obtaining information
about or related to a domain name registration record. VeriSign does not
guarantee its accuracy. By submitting a Whois query, you agree to abide
by the following terms of use: You agree that you may use this Data only
for lawful purposes and that under no circumstances will you use this Data
to: (1) allow, enable, or otherwise support the transmission of mass
unsolicited, commercial advertising or solicitations via e-mail, telephone,
or facsimile; or (2) enable high volume, automated, electronic processes
that apply to VeriSign (or its computer systems). The compilation,
repackaging, dissemination or other use of this Data is expressly
prohibited without the prior written consent of VeriSign. You agree not to
use electronic processes that are automated and high-volume to access or
query the Whois database except as reasonably necessary to register
domain names or modify existing registrations. VeriSign reserves the right
to restrict your access to the Whois database in its sole discretion to ensure
operational stability.  VeriSign may restrict or terminate your access to the
Whois database for failure to abide by these terms of use. VeriSign
reserves the right to modify these terms at any time.

The Registry database contains ONLY .COM, .NET, .EDU domains and
Registrars.