Email provider status: DMARC, MTA-STS and SPF, checked every hour
The live email-authentication settings of the big mailbox providers and sending services, re-checked every hour from public DNS. When Gmail, Outlook or Yahoo change a policy, or a sending service's SPF include grows, it shows up here first. Last check: 2026-10-25T11:17:03Z.
Mailbox providers
| Domain | DMARC | MTA-STS | TLS-RPT | BIMI |
|---|---|---|---|---|
| aol.com | p=reject | none | no | no |
| fastmail.com | p=none | testing | yes | no |
| gmail.com | p=none, sp=quarantine | enforce | yes | no |
| gmx.com | p=quarantine | testing | yes | no |
| googlemail.com | p=quarantine, sp=quarantine | enforce | yes | no |
| hotmail.com | p=none | enforce | yes | no |
| icloud.com | p=quarantine, sp=quarantine | none | no | yes |
| live.com | p=none, sp=quarantine | enforce | yes | no |
| mail.com | p=quarantine | testing | yes | no |
| me.com | p=quarantine, sp=quarantine | none | no | yes |
| outlook.com | p=none, sp=quarantine | enforce | yes | no |
| proton.me | p=quarantine | enforce | yes | yes |
| yahoo.com | p=reject | testing | yes | no |
| yandex.com | p=none | none | no | no |
| zoho.com | p=reject, sp=reject | none | yes | no |
Why it matters: when a provider moves its own DMARC from p=none to quarantine or reject, mail that uses
From: someone@thatprovider.com but is sent from other servers (website contact forms, apps) starts going to spam or bouncing.
What each SPF include costs you
| Include | Service | DNS lookups (of your 10) | IP ranges |
|---|---|---|---|
include:email.freshdesk.com | Freshdesk | 7 | 70 |
include:mailgun.org | Mailgun | 5 | 22 |
include:_spf.mail.hostinger.com | Hostinger Mail | 3 | 8 |
include:secureserver.net | GoDaddy | 3 | 44 |
include:_spf.elasticemail.com | Elastic Email | 2 | 0 |
include:_spf.protonmail.ch | Proton Mail | 2 | 11 |
include:_spf.salesforce.com | Salesforce | 2 | 0 |
include:sendgrid.net | SendGrid | 2 | 15 |
include:sparkpostmail.com | SparkPost | 2 | 0 |
include:zohomail.com | Zoho Mail | 2 | 8 |
include:_spf.createsend.com | Campaign Monitor | 1 | 6 |
include:_spf.google.com | Google Workspace | 1 | 8 |
include:_spf.mlsend.com | MailerLite | 1 | 2 |
include:_spf.mx.cloudflare.net | Cloudflare Email Routing | 1 | 2 |
include:amazonses.com | Amazon SES | 1 | 13 |
include:helpscoutemail.com | Help Scout | 1 | 6 |
include:mail.zendesk.com | Zendesk | 1 | 5 |
include:relay.mailchannels.net | MailChannels | 1 | 2 |
include:servers.mcsv.net | Mailchimp | 1 | 3 |
include:shops.shopify.com | Shopify | 1 | 0 |
include:spf.brevo.com | Brevo | 1 | 10 |
include:spf.mailjet.com | Mailjet | 1 | 5 |
include:spf.mandrillapp.com | Mailchimp Transactional (Mandrill) | 1 | 12 |
include:spf.mtasv.net | Postmark | 1 | 4 |
include:spf.protection.outlook.com | Microsoft 365 | 1 | 11 |
Over 10 lookups in total breaks SPF for all your mail. Build one record with the SPF generator; details per include in the SPF include directory.
Microsoft 365 MX move
Of 7 large Microsoft 365 organisations we watch, 1 already uses the new
*.mx.microsoft mail servers. Domains with MTA-STS in enforce mode must add the exact new host (or
*.<region>-v1.mx.microsoft) before their MX moves: a plain mx: *.mx.microsoft line does not match
those hosts, because an MTA-STS wildcard covers one label only – details.
Recent changes
- No significant changes recorded since monitoring started on 25 Oct 2026.
Check your own domain
After the fix, send a test email to see SPF, DKIM and DMARC pass on a real message, then keep an eye on it: free DMARC monitoring shows every service that sends mail as your domain and which ones fail, in plain English.
Get it fixed on Fiverr
Prefer to do it yourself? Get the step-by-step Fix Kit ($15) – 28-page guide, checklist, 20+ providers.