gmx.at: mail servers, SPF, DMARC, DKIM and reputation

Mail servers for gmx.at

gmx.at publishes 2 MX records. Senders deliver to the lowest-priority host first, mx00.emig.gmx.net, and fall back down the list if it does not answer.

Who runs the mail

The hosts match the pattern of GMX. GMX is a consumer mailbox provider; its servers reject unknown addresses during the handshake, so checks are definitive.

What this means for verification

An address at gmx.at passes the free checks (syntax, MX, lists), so the API goes on to the mailbox-level SMTP handshake, which ends before any message is sent. The result is deliverable, risky, or undeliverable with a reason field that names the evidence.

SPF for gmx.at

gmx.at publishes an SPF record; it names its senders directly rather than through include mechanisms, and the record has no explicit all mechanism, so receivers treat unlisted servers as neutral.

DMARC for gmx.at

The DMARC policy for gmx.at is p=quarantine: failing mail is delivered to spam rather than refused. It is the common intermediate step between monitoring and rejecting.

Why it matters

SPF says which servers may send as gmx.at; DKIM signs the messages; DMARC tells receivers what to do when neither checks out and reports back to the owner. Together they decide whether mail from gmx.at is trusted, and whether someone else can pretend to be gmx.at. For verification they are a domain-quality signal: Spaw folds a missing SPF record into the risk score and reports has_spf and dmarc_policy on every email and domain lookup.

DKIM keys for gmx.at

None of the common selectors publishes a key for gmx.at. That does not mean gmx.at signs nothing: a selector can be any label, and a domain that signs with one of its own (s2024, k2, mail-eu) is invisible to a list of common names. Only a DMARC report, or the DKIM-Signature header on a real message, names the selector for certain.

What the check reads

DKIM keys live in DNS at <selector>._domainkey.gmx.at, one TXT record per selector, and the selector is chosen by whoever signs the mail. This checker asks for the selectors the large providers and sending platforms use by default (google, selector1 and selector2 for Microsoft 365, k1, s1, fm1 and about thirty more), so a key found here is a real key, and a key not found here may simply sit under a name the list does not know.

How it fits with SPF and DMARC

The DMARC policy for gmx.at is p=quarantine: failing mail is delivered to spam rather than refused. It is the common intermediate step between monitoring and rejecting. gmx.at publishes an SPF record; it names its senders directly rather than through include mechanisms, and the record has no explicit all mechanism, so receivers treat unlisted servers as neutral.

Transport security for gmx.at

gmx.at publishes no an MTA-STS policy record record at _mta-sts.gmx.at. Without MTA-STS, a sender that cannot negotiate TLS with the mail host may fall back to delivering in the clear, and an attacker on the path can force exactly that. gmx.at publishes no a TLS-RPT record record at _smtp._tls.gmx.at. TLS-RPT would give the domain owner a daily report of delivery attempts that could not establish TLS; without it, failures are invisible.

Brand indicators for gmx.at

gmx.at publishes no a BIMI record record at default._bimi.gmx.at. BIMI is optional and mostly cosmetic; it only becomes possible once DMARC enforces quarantine or reject.

SPF details for gmx.at

gmx.at publishes SPF. The policy's all qualifier is ~all (soft fail: unlisted servers are marked suspicious but usually delivered). Evaluating it takes 1 DNS lookup, within the ten RFC 7208 allows.

DMARC details for gmx.at

The DMARC policy for gmx.at is p=quarantine: failing mail is delivered to spam rather than refused. It is the common intermediate step between monitoring and rejecting. The policy applies to all of the domain's mail (pct=100). Aggregate reports are collected (rua= is set), so the owner sees who sends as the domain.

Is gmx.at disposable?

gmx.at is a free consumer mailbox provider, the kind used for personal accounts. Addresses there are legitimate, but they say nothing about the person's company.

About the domain

Its mail is handled by GMX.

How Spaw treats addresses at gmx.at

An address at gmx.at passes the free checks (syntax, MX, lists), so the API goes on to the mailbox-level SMTP handshake, which ends before any message is sent. The result is deliverable, risky, or undeliverable with a reason field that names the evidence.

Common questions about gmx.at

Does gmx.at accept mail?

gmx.at accepts mail through gmx's mail servers.

Does gmx.at publish SPF and DMARC?

gmx.at publishes SPF ending in ~all and a DMARC policy of quarantine.

Is gmx.at a disposable, relay or free-provider domain?

gmx.at is a free mailbox provider, so an address there is a consumer inbox rather than a company's.

Does gmx.at publish DKIM, MTA-STS, TLS-RPT or BIMI?

gmx.at does not publish MTA-STS, does not publish TLS-RPT and does not publish BIMI. None of the common DKIM selectors publishes a key, which does not mean the domain signs nothing: a selector outside the common list is invisible to this check.

Where does this report come from?

Live DNS, the open disposable, role and free-provider lists, the registry's RDAP record and the threat blocklists the IP product installs, read on 2026-10-23 and cached for a week. Nothing here says anything about a person; it describes the domain's mail setup on that day.

Check another domain

• Email checker
• MX record lookup
• SPF & DMARC checker
• Disposable email domain checker
• DKIM checker
• MTA-STS, TLS-RPT and BIMI checker
• The same answer over the API: GET /api/v1/email/domain/gmx.at