freenet.de: mail servers, SPF, DMARC, DKIM and reputation
Everything Spaw reads about freenet.de, on one page: a free mailbox provider, checked from live DNS, the open disposable, role and free-provider lists, the registry's RDAP record and the threat blocklists, and cached for a week.
Mail servers
- Accepts mail
- yes
- MX status
- accepts_mail
- MX hosts
- mx.freenet.de
- Provider
- other
- Provider type
- self_hosted
- Mail hosts on a threat blocklist
- no
- Mail host network
- —
- Known catch-all
- not evaluated
SPF and DMARC
- SPF published
- yes
- SPF record
- v=spf1 redirect=_spf.freenet.de
- SPF all-qualifier
- ~all
- SPF DNS lookups
- 1
- DMARC policy
- quarantine
- DMARC record
- v=DMARC1; p=quarantine; rua=mailto:[email protected]
- DMARC pct
- 100
- DMARC reports collected
- yes
DKIM, MTA-STS, TLS-RPT and BIMI
- DKIM selectors found
- none of the common selectors
- MTA-STS
- yes
- TLS-RPT
- yes
- BIMI
- no
Registration
- Registered
- —
- Age
- —
- Expires
- —
- Last changed
- —
- Registrar
- —
- Registrant withheld
- not evaluated
What kind of domain
- Category
- webmail
- Free mailbox provider
- yes
- Disposable
- no
- Relay service
- no
- Parked
- no
Mail servers for freenet.de
DNS lists 1 mail host for freenet.de, starting with mx.freenet.de. Lower priority values are tried first; the rest exist for failover.
Who runs the mail
The hosts match the pattern of an unrecognised provider. The mail hosts do not match a known provider pattern, so the domain is probably self-hosted or on a smaller provider. Catch-all behaviour varies from server to server, which is exactly why a mailbox-level probe, not the MX record, decides whether an address exists.
What this means for verification
For freenet.de, verification runs the whole pipeline: syntax, live MX, the open lists, and then the SMTP handshake with the mail host, with no message ever transmitted. Each verdict carries a machine-readable reason.
SPF for freenet.de
freenet.de publishes an SPF record; it names its senders directly rather than through include mechanisms, and the record has no explicit all mechanism, so receivers treat unlisted servers as neutral.
DMARC for freenet.de
freenet.de publishes DMARC with p=quarantine, which tells receivers to sideline mail that fails alignment instead of blocking it. Many domains stay here while they tidy up legitimate senders.
Why it matters
Receivers use SPF, DKIM, and DMARC together to decide whether a message really came from freenet.de. A domain with a strict SPF record and an enforcing DMARC policy is hard to spoof and easier to deliver for; one without either is neither. Spaw reports has_spf and dmarc_policy on every lookup and adds a small risk weight when SPF is missing.
DKIM keys for freenet.de
freenet.de publishes no DKIM key under any of the common selectors this checker knows. Read that narrowly: DKIM selectors are free-form labels, so a domain signing under its own private selector name passes this check unseen. The selector on a real message's DKIM-Signature header is the only definitive answer.
What the check reads
DKIM keys live in DNS at <selector>._domainkey.freenet.de, one TXT record per selector, and the selector is chosen by whoever signs the mail. This checker asks for the selectors the large providers and sending platforms use by default (google, selector1 and selector2 for Microsoft 365, k1, s1, fm1 and about thirty more), so a key found here is a real key, and a key not found here may simply sit under a name the list does not know.
How it fits with SPF and DMARC
freenet.de publishes DMARC with p=quarantine, which tells receivers to sideline mail that fails alignment instead of blocking it. Many domains stay here while they tidy up legitimate senders. freenet.de publishes an SPF record; it names its senders directly rather than through include mechanisms, and the record has no explicit all mechanism, so receivers treat unlisted servers as neutral.
Transport security for freenet.de
freenet.de publishes an MTA-STS policy record at _mta-sts.freenet.de. MTA-STS tells sending servers to insist on a valid TLS certificate when they deliver to this domain, which closes the downgrade attack that opportunistic STARTTLS leaves open. freenet.de publishes a TLS-RPT record at _smtp._tls.freenet.de. TLS-RPT is where senders report the connections that failed to negotiate TLS, so the domain owner sees the failures MTA-STS causes.
Brand indicators for freenet.de
freenet.de publishes no a BIMI record record at default._bimi.freenet.de. BIMI is optional and mostly cosmetic; it only becomes possible once DMARC enforces quarantine or reject.
SPF details for freenet.de
freenet.de publishes SPF. The policy's all qualifier is ~all (soft fail: unlisted servers are marked suspicious but usually delivered). Evaluating it takes 1 DNS lookup, within the ten RFC 7208 allows.
DMARC details for freenet.de
freenet.de publishes DMARC with p=quarantine, which tells receivers to sideline mail that fails alignment instead of blocking it. Many domains stay here while they tidy up legitimate senders. The policy applies to all of the domain's mail (pct=100). Aggregate reports are collected (rua= is set), so the owner sees who sends as the domain.
Is freenet.de disposable?
freenet.de is a consumer email service rather than a company domain: real people, personal accounts, and no way to infer an employer from the address.
About the domain
Its mail is handled by an unrecognised provider.
How Spaw treats addresses at freenet.de
For freenet.de, verification runs the whole pipeline: syntax, live MX, the open lists, and then the SMTP handshake with the mail host, with no message ever transmitted. Each verdict carries a machine-readable reason.
Common questions about freenet.de
- Does freenet.de accept mail?
- freenet.de accepts mail through its own mail servers.
- Does freenet.de publish SPF and DMARC?
- freenet.de publishes SPF ending in ~all and a DMARC policy of quarantine.
- Is freenet.de a disposable, relay or free-provider domain?
- freenet.de is a free mailbox provider, so an address there is a consumer inbox rather than a company's.
- Does freenet.de publish DKIM, MTA-STS, TLS-RPT or BIMI?
- freenet.de publishes MTA-STS, publishes TLS-RPT and does not publish BIMI. None of the common DKIM selectors publishes a key, which does not mean the domain signs nothing: a selector outside the common list is invisible to this check.
- Where does this report come from?
- Live DNS, the open disposable, role and free-provider lists, the registry's RDAP record and the threat blocklists the IP product installs, read on 2026-10-08 and cached for a week. Nothing here says anything about a person; it describes the domain's mail setup on that day.
Check another domain
checked 2026-10-08 · sources: live-dns@2026-10-11 · disposable-domains@2026-10-05 · free-provider-domains@2026-10-05 · mx-provider-patterns@2026-10-08 · forwarding-services@2026-10-08 · domain-categories@2026-09-12 · parking-nameservers@2026-09-12 · threat-blocklists@2026-10-11 · mail-policies@2026-09-12
More free tools
All free toolsNeed this at scale?
The Spaw API runs the same checks plus mailbox-level SMTP verification, batch and bulk endpoints, and list monitoring — 100 free credits a month, no card required.