disroot.org: mail servers, SPF, DMARC, DKIM and reputation

Mail servers for disroot.org

disroot.org publishes 1 MX record. Senders deliver to the lowest-priority host first, disroot.org, and fall back down the list if it does not answer.

Who runs the mail

The hosts match the pattern of an unrecognised provider. The mail hosts do not match a known provider pattern, so the domain is probably self-hosted or on a smaller provider. Catch-all behaviour varies from server to server, which is exactly why a mailbox-level probe, not the MX record, decides whether an address exists.

What this means for verification

An address at disroot.org passes the free checks (syntax, MX, lists), so the API goes on to the mailbox-level SMTP handshake, which ends before any message is sent. The result is deliverable, risky, or undeliverable with a reason field that names the evidence.

SPF for disroot.org

disroot.org publishes an SPF record; it names its senders directly rather than through include mechanisms, and the record ends in -all (hard fail): mail from a server that is not listed should be rejected.

DMARC for disroot.org

The DMARC policy for disroot.org is p=reject: mail that fails SPF and DKIM alignment is refused outright. It is the strictest setting and the one Gmail and Yahoo now expect from bulk senders.

Why it matters

SPF says which servers may send as disroot.org; DKIM signs the messages; DMARC tells receivers what to do when neither checks out and reports back to the owner. Together they decide whether mail from disroot.org is trusted, and whether someone else can pretend to be disroot.org. For verification they are a domain-quality signal: Spaw folds a missing SPF record into the risk score and reports has_spf and dmarc_policy on every email and domain lookup.

DKIM keys for disroot.org

disroot.org publishes a DKIM key under 1 common selector: mail. Mail signed with one of these can be verified by any receiver, and a DMARC policy can require that signature to align with the From domain.

What the check reads

DKIM keys live in DNS at <selector>._domainkey.disroot.org, one TXT record per selector, and the selector is chosen by whoever signs the mail. This checker asks for the selectors the large providers and sending platforms use by default (google, selector1 and selector2 for Microsoft 365, k1, s1, fm1 and about thirty more), so a key found here is a real key, and a key not found here may simply sit under a name the list does not know.

How it fits with SPF and DMARC

The DMARC policy for disroot.org is p=reject: mail that fails SPF and DKIM alignment is refused outright. It is the strictest setting and the one Gmail and Yahoo now expect from bulk senders. disroot.org publishes an SPF record; it names its senders directly rather than through include mechanisms, and the record ends in -all (hard fail): mail from a server that is not listed should be rejected.

Transport security for disroot.org

disroot.org publishes an MTA-STS policy record at _mta-sts.disroot.org. MTA-STS tells sending servers to insist on a valid TLS certificate when they deliver to this domain, which closes the downgrade attack that opportunistic STARTTLS leaves open. disroot.org publishes a TLS-RPT record at _smtp._tls.disroot.org. TLS-RPT is where senders report the connections that failed to negotiate TLS, so the domain owner sees the failures MTA-STS causes.

Brand indicators for disroot.org

disroot.org publishes no a BIMI record record at default._bimi.disroot.org. BIMI is optional and mostly cosmetic; it only becomes possible once DMARC enforces quarantine or reject.

SPF details for disroot.org

disroot.org publishes SPF. The policy's all qualifier is -all (hard fail: unlisted servers are rejected). Evaluating it takes 2 DNS lookups, within the ten RFC 7208 allows.

DMARC details for disroot.org

The DMARC policy for disroot.org is p=reject: mail that fails SPF and DKIM alignment is refused outright. It is the strictest setting and the one Gmail and Yahoo now expect from bulk senders. The policy applies to all of the domain's mail (pct=100). Aggregate reports are collected (rua= is set), so the owner sees who sends as the domain.

Is disroot.org disposable?

disroot.org is a free consumer mailbox provider, the kind used for personal accounts. Addresses there are legitimate, but they say nothing about the person's company.

About the domain

Its mail is handled by an unrecognised provider.

How Spaw treats addresses at disroot.org

An address at disroot.org passes the free checks (syntax, MX, lists), so the API goes on to the mailbox-level SMTP handshake, which ends before any message is sent. The result is deliverable, risky, or undeliverable with a reason field that names the evidence.

Common questions about disroot.org

Does disroot.org accept mail?

disroot.org accepts mail through its own mail servers.

Does disroot.org publish SPF and DMARC?

disroot.org publishes SPF ending in -all and a DMARC policy of reject.

Is disroot.org a disposable, relay or free-provider domain?

disroot.org is a free mailbox provider, so an address there is a consumer inbox rather than a company's.

Does disroot.org publish DKIM, MTA-STS, TLS-RPT or BIMI?

disroot.org publishes MTA-STS, publishes TLS-RPT and does not publish BIMI. DKIM keys were found under the selector mail.

Where does this report come from?

Live DNS, the open disposable, role and free-provider lists, the registry's RDAP record and the threat blocklists the IP product installs, read on 2026-10-08 and cached for a week. Nothing here says anything about a person; it describes the domain's mail setup on that day.

Check another domain

• Email checker
• MX record lookup
• SPF & DMARC checker
• Disposable email domain checker
• DKIM checker
• MTA-STS, TLS-RPT and BIMI checker
• The same answer over the API: GET /api/v1/email/domain/disroot.org