Barracuda Email Gateway Defense (formerly Barracuda Essentials) is a hosted security gateway used mostly by small and mid-size organisations, often sold through IT service providers. Companies point their MX at Barracuda, which filters inbound mail and hands it to the mailbox host behind it. Spaw reports such domains as mx_provider: "barracuda".
How Barracuda shows up in DNS
Domains behind the service publish a pair of MX records under ess.barracudanetworks.com, such as d160221a.ess.barracudanetworks.com and d160221b.ess.barracudanetworks.com, with regional variants for Europe, Australia, Canada and other data centres. Spaw matches the .barracudanetworks.com suffix. The target is a filtering layer, so mx_provider identifies the gateway rather than where the mailboxes live.
How Barracuda answers a verification handshake
Barracuda's gateway supports recipient verification: when the customer has connected the service to their directory (Microsoft 365 or Google Workspace synchronisation, or an LDAP lookup), unknown recipients are rejected at RCPT TO. That integration is common among Barracuda's customer base because the same connection drives the rest of the product, so clean answers are more frequent here than behind some other gateways. Without it, the gateway accepts every recipient and the domain answers as catch-all. Barracuda also applies sender reputation checks and rate limits before the recipient step, so a probe from an unfamiliar source is occasionally deferred.
What that means for your verdicts
Domains with recipient verification answer deliverable with mailbox_exists: true or undeliverable with reason: mailbox_not_found and smtp_reason: no_mailbox. The rest answer risky with reason: catch_all; Spaw remembers that per domain for seven days and returns mailbox_confidence for each address, with the ten-point bonus for an established provider and adjustments for DMARC, SPF, the domain's age, the username's shape and your own delivery outcomes. Deferred probes show smtp_reason: greylisted, and callback_url re-checks them after 5 and 20 minutes for free.
As with every gateway, your delivery feedback carries the most weight: a delivered report confirms the mailbox for later lookups (smtp_reason: delivered_recently), and bounces lower the confidence for the whole domain.
SPF and DMARC at Barracuda
Companies that also send outbound mail through the service add include:spf.ess.barracudanetworks.com to their SPF record for the US instance, or a regional variant such as include:spf.ess.uk.barracudanetworks.com, include:spf.ess.de.barracudanetworks.com, include:spf.ess.au.barracudanetworks.com or include:spf.ess.ca.barracudanetworks.com, as Barracuda's documentation lists them. The inbound filter does not change the domain's own SPF and DMARC, which Spaw reports live in has_spf and dmarc_policy.
Practical notes for sending to domains behind Barracuda
Barracuda's customer base skews to smaller organisations: schools, clinics, local government and firms with an outsourced IT provider. Their gateways are often tuned strictly, and their lists change with staff turnover, so re-verifying on a schedule pays off. A mailbox_not_found from a Barracuda gateway with recipient verification is as reliable as one from the mailbox host itself.
For a live look at any Barracuda-protected domain, run it through the free MX lookup and the SPF and DMARC checker.