189.cn: mail servers, SPF, DMARC, DKIM and reputation

Mail servers for 189.cn

DNS lists 3 mail hosts for 189.cn, starting with mta-189.21cn.com. Lower priority values are tried first; the rest exist for failover.

Who runs the mail

The hosts match the pattern of an unrecognised provider. The mail hosts do not match a known provider pattern, so the domain is probably self-hosted or on a smaller provider. Catch-all behaviour varies from server to server, which is exactly why a mailbox-level probe, not the MX record, decides whether an address exists.

What this means for verification

For 189.cn, verification runs the whole pipeline: syntax, live MX, the open lists, and then the SMTP handshake with the mail host, with no message ever transmitted. Each verdict carries a machine-readable reason.

SPF for 189.cn

189.cn publishes an SPF record; it authorises 2 included sender lists, and the record ends in -all (hard fail): mail from a server that is not listed should be rejected.

DMARC for 189.cn

There is no DMARC record for 189.cn, so failed SPF or DKIM checks lead nowhere: no quarantine, no rejection, and no reports back to the owner.

Why it matters

Receivers use SPF, DKIM, and DMARC together to decide whether a message really came from 189.cn. A domain with a strict SPF record and an enforcing DMARC policy is hard to spoof and easier to deliver for; one without either is neither. Spaw reports has_spf and dmarc_policy on every lookup and adds a small risk weight when SPF is missing.

DKIM keys for 189.cn

189.cn publishes no DKIM key under any of the common selectors this checker knows. Read that narrowly: DKIM selectors are free-form labels, so a domain signing under its own private selector name passes this check unseen. The selector on a real message's DKIM-Signature header is the only definitive answer.

What the check reads

DKIM keys live in DNS at <selector>._domainkey.189.cn, one TXT record per selector, and the selector is chosen by whoever signs the mail. This checker asks for the selectors the large providers and sending platforms use by default (google, selector1 and selector2 for Microsoft 365, k1, s1, fm1 and about thirty more), so a key found here is a real key, and a key not found here may simply sit under a name the list does not know.

How it fits with SPF and DMARC

There is no DMARC record for 189.cn, so failed SPF or DKIM checks lead nowhere: no quarantine, no rejection, and no reports back to the owner. 189.cn publishes an SPF record; it authorises 2 included sender lists, and the record ends in -all (hard fail): mail from a server that is not listed should be rejected.

Transport security for 189.cn

189.cn publishes no an MTA-STS policy record record at _mta-sts.189.cn. Without MTA-STS, a sender that cannot negotiate TLS with the mail host may fall back to delivering in the clear, and an attacker on the path can force exactly that. 189.cn publishes no a TLS-RPT record record at _smtp._tls.189.cn. TLS-RPT would give the domain owner a daily report of delivery attempts that could not establish TLS; without it, failures are invisible.

Brand indicators for 189.cn

189.cn publishes no a BIMI record record at default._bimi.189.cn. BIMI is optional and mostly cosmetic; it only becomes possible once DMARC enforces quarantine or reject.

SPF details for 189.cn

189.cn publishes SPF. The policy's all qualifier is -all (hard fail: unlisted servers are rejected). Evaluating it takes 5 DNS lookups, within the ten RFC 7208 allows.

DMARC details for 189.cn

There is no DMARC record for 189.cn, so failed SPF or DKIM checks lead nowhere: no quarantine, no rejection, and no reports back to the owner.

Is 189.cn disposable?

189.cn is a consumer email service rather than a company domain: real people, personal accounts, and no way to infer an employer from the address.

About the domain

Its mail is handled by an unrecognised provider.

How Spaw treats addresses at 189.cn

For 189.cn, verification runs the whole pipeline: syntax, live MX, the open lists, and then the SMTP handshake with the mail host, with no message ever transmitted. Each verdict carries a machine-readable reason.

Common questions about 189.cn

Does 189.cn accept mail?

189.cn accepts mail through a third-party mail host.

Does 189.cn publish SPF and DMARC?

189.cn publishes SPF but no DMARC policy, so receivers are told which servers may send for it but not what to do with mail that fails.

Is 189.cn a disposable, relay or free-provider domain?

189.cn is a free mailbox provider, so an address there is a consumer inbox rather than a company's.

Does 189.cn publish DKIM, MTA-STS, TLS-RPT or BIMI?

189.cn does not publish MTA-STS, does not publish TLS-RPT and does not publish BIMI. None of the common DKIM selectors publishes a key, which does not mean the domain signs nothing: a selector outside the common list is invisible to this check.

Where does this report come from?

Live DNS, the open disposable, role and free-provider lists, the registry's RDAP record and the threat blocklists the IP product installs, read on 2026-10-22 and cached for a week. Nothing here says anything about a person; it describes the domain's mail setup on that day.

Check another domain

• Email checker
• MX record lookup
• SPF & DMARC checker
• Disposable email domain checker
• DKIM checker
• MTA-STS, TLS-RPT and BIMI checker
• The same answer over the API: GET /api/v1/email/domain/189.cn