# Barracuda Email Gateway Defense: MX records and email verification

How domains behind Barracuda look in DNS, how the gateway answers a verification handshake, and which verdicts to expect for Barracuda-protected addresses.

Updated: 2026-09-03

Barracuda Email Gateway Defense (formerly Barracuda Essentials) is a hosted security gateway used mostly by small and mid-size organisations, often sold through IT service providers. Companies point their MX at Barracuda, which filters inbound mail and hands it to the mailbox host behind it. Spaw reports such domains as `mx_provider: "barracuda"`.

## How Barracuda shows up in DNS

Domains behind the service publish a pair of MX records under `ess.barracudanetworks.com`, such as `d160221a.ess.barracudanetworks.com` and `d160221b.ess.barracudanetworks.com`, with regional variants for Europe, Australia, Canada and other data centres. Spaw matches the `.barracudanetworks.com` suffix. The target is a filtering layer, so `mx_provider` identifies the gateway rather than where the mailboxes live.

## How Barracuda answers a verification handshake

Barracuda's gateway supports recipient verification: when the customer has connected the service to their directory (Microsoft 365 or Google Workspace synchronisation, or an LDAP lookup), unknown recipients are rejected at `RCPT TO`. That integration is common among Barracuda's customer base because the same connection drives the rest of the product, so clean answers are more frequent here than behind some other gateways. Without it, the gateway accepts every recipient and the domain answers as catch-all. Barracuda also applies sender reputation checks and rate limits before the recipient step, so a probe from an unfamiliar source is occasionally deferred.

## What that means for your verdicts

Domains with recipient verification answer `deliverable` with `mailbox_exists: true` or `undeliverable` with `reason: mailbox_not_found` and `smtp_reason: no_mailbox`. The rest answer `risky` with `reason: catch_all`; Spaw remembers that per domain for seven days and returns `mailbox_confidence` for each address, with the ten-point bonus for an established provider and adjustments for DMARC, SPF, the domain's age, the username's shape and your own delivery outcomes. Deferred probes show `smtp_reason: greylisted`, and `callback_url` re-checks them after 5 and 20 minutes for free.

As with every gateway, your delivery feedback carries the most weight: a delivered report confirms the mailbox for later lookups (`smtp_reason: delivered_recently`), and bounces lower the confidence for the whole domain.

## SPF and DMARC at Barracuda

Companies that also send outbound mail through the service add `include:spf.ess.barracudanetworks.com` to their SPF record for the US instance, or a regional variant such as `include:spf.ess.uk.barracudanetworks.com`, `include:spf.ess.de.barracudanetworks.com`, `include:spf.ess.au.barracudanetworks.com` or `include:spf.ess.ca.barracudanetworks.com`, as Barracuda's documentation lists them. The inbound filter does not change the domain's own SPF and DMARC, which Spaw reports live in `has_spf` and `dmarc_policy`.

## Practical notes for sending to domains behind Barracuda

Barracuda's customer base skews to smaller organisations: schools, clinics, local government and firms with an outsourced IT provider. Their gateways are often tuned strictly, and their lists change with staff turnover, so re-verifying on a schedule pays off. A `mailbox_not_found` from a Barracuda gateway with recipient verification is as reliable as one from the mailbox host itself.

For a live look at any Barracuda-protected domain, run it through the free MX lookup and the SPF and DMARC checker.

Reference: https://spaw.co/email-providers/barracuda