fastmail.fm: mail servers, SPF, DMARC, DKIM and reputation

Mail servers for fastmail.fm

DNS lists 2 mail hosts for fastmail.fm, starting with in1-smtp.messagingengine.com. Lower priority values are tried first; the rest exist for failover.

Who runs the mail

The hosts match the pattern of Fastmail. Fastmail hosts the mailboxes and answers the handshake honestly, so an address that does not exist is rejected outright and verdicts are definitive.

What this means for verification

For fastmail.fm, verification runs the whole pipeline: syntax, live MX, the open lists, and then the SMTP handshake with the mail host, with no message ever transmitted. Each verdict carries a machine-readable reason.

SPF for fastmail.fm

fastmail.fm publishes an SPF record; it authorises 1 included sender list, and the record ends in ~all (soft fail): mail from unlisted servers is marked suspicious but usually still delivered.

DMARC for fastmail.fm

fastmail.fm has DMARC in monitoring mode (p=none). Receivers report what they see but deliver failing mail anyway, so the record protects nothing yet.

Why it matters

Receivers use SPF, DKIM, and DMARC together to decide whether a message really came from fastmail.fm. A domain with a strict SPF record and an enforcing DMARC policy is hard to spoof and easier to deliver for; one without either is neither. Spaw reports has_spf and dmarc_policy on every lookup and adds a small risk weight when SPF is missing.

DKIM keys for fastmail.fm

3 DKIM selectors found for fastmail.fm (fm1, fm2, fm3). Each is a public key in DNS that receivers use to check the signature on messages from fastmail.fm; together with SPF it is what a DMARC policy enforces.

What the check reads

DKIM keys live in DNS at <selector>._domainkey.fastmail.fm, one TXT record per selector, and the selector is chosen by whoever signs the mail. This checker asks for the selectors the large providers and sending platforms use by default (google, selector1 and selector2 for Microsoft 365, k1, s1, fm1 and about thirty more), so a key found here is a real key, and a key not found here may simply sit under a name the list does not know.

How it fits with SPF and DMARC

fastmail.fm has DMARC in monitoring mode (p=none). Receivers report what they see but deliver failing mail anyway, so the record protects nothing yet. fastmail.fm publishes an SPF record; it authorises 1 included sender list, and the record ends in ~all (soft fail): mail from unlisted servers is marked suspicious but usually still delivered.

Transport security for fastmail.fm

fastmail.fm publishes an MTA-STS policy record at _mta-sts.fastmail.fm. MTA-STS tells sending servers to insist on a valid TLS certificate when they deliver to this domain, which closes the downgrade attack that opportunistic STARTTLS leaves open. fastmail.fm publishes a TLS-RPT record at _smtp._tls.fastmail.fm. TLS-RPT is where senders report the connections that failed to negotiate TLS, so the domain owner sees the failures MTA-STS causes.

Brand indicators for fastmail.fm

fastmail.fm publishes no a BIMI record record at default._bimi.fastmail.fm. BIMI is optional and mostly cosmetic; it only becomes possible once DMARC enforces quarantine or reject.

SPF details for fastmail.fm

fastmail.fm publishes SPF. The policy's all qualifier is ~all (soft fail: unlisted servers are marked suspicious but usually delivered). Evaluating it takes 1 DNS lookup, within the ten RFC 7208 allows.

DMARC details for fastmail.fm

fastmail.fm has DMARC in monitoring mode (p=none). Receivers report what they see but deliver failing mail anyway, so the record protects nothing yet. The policy applies to all of the domain's mail (pct=100). Aggregate reports are collected (rua= is set), so the owner sees who sends as the domain.

Is fastmail.fm disposable?

fastmail.fm is a consumer email service rather than a company domain: real people, personal accounts, and no way to infer an employer from the address.

About the domain

Its mail is handled by Fastmail.

How Spaw treats addresses at fastmail.fm

For fastmail.fm, verification runs the whole pipeline: syntax, live MX, the open lists, and then the SMTP handshake with the mail host, with no message ever transmitted. Each verdict carries a machine-readable reason.

Common questions about fastmail.fm

Does fastmail.fm accept mail?

fastmail.fm accepts mail through fastmail's mail servers.

Does fastmail.fm publish SPF and DMARC?

fastmail.fm publishes SPF ending in ~all and a DMARC policy of none.

Is fastmail.fm a disposable, relay or free-provider domain?

fastmail.fm is a free mailbox provider, so an address there is a consumer inbox rather than a company's.

Does fastmail.fm publish DKIM, MTA-STS, TLS-RPT or BIMI?

fastmail.fm publishes MTA-STS, publishes TLS-RPT and does not publish BIMI. DKIM keys were found under the selectors fm1, fm2, fm3.

Where does this report come from?

Live DNS, the open disposable, role and free-provider lists, the registry's RDAP record and the threat blocklists the IP product installs, read on 2026-10-22 and cached for a week. Nothing here says anything about a person; it describes the domain's mail setup on that day.

Check another domain

• Email checker
• MX record lookup
• SPF & DMARC checker
• Disposable email domain checker
• DKIM checker
• MTA-STS, TLS-RPT and BIMI checker
• The same answer over the API: GET /api/v1/email/domain/fastmail.fm