GMX is one of the two big German consumer mailbox providers, run by 1&1 Mail & Media alongside its sister brand WEB.DE. It serves gmx.net, gmx.de, gmx.at, gmx.ch and the international gmx.com, all on the same platform. Spaw reports the GMX domains as mx_provider: "gmx".
How GMX shows up in DNS
GMX domains publish MX records under gmx.net: gmx.net and gmx.de point at mx00.emig.gmx.net and mx01.emig.gmx.net, and gmx.com at mx00.gmx.net and mx01.gmx.net. Spaw matches the .gmx.net suffix. WEB.DE, despite sharing the infrastructure, uses hosts under web.de and classifies as other until the classifier learns that pattern. GMX is a mailbox host: mx_found is true and mx_implicit is false.
How GMX answers a verification handshake
GMX rejects unknown recipients at RCPT TO, so a missing mailbox is confirmed in the session. The provider is strict about who it talks to at all: it enforces reverse DNS on the connecting host, applies reputation checks before the recipient step, and greylists or refuses connections from sources it does not trust. A probe from infrastructure GMX has not seen is therefore more likely than average to end with smtp_reason: greylisted or no_connect rather than an answer.
What that means for your verdicts
Confirmed answers are deliverable with mailbox_exists: true or undeliverable with reason: mailbox_not_found and smtp_reason: no_mailbox. Unverified probes leave smtp_checked: false and mailbox_exists: null, the verdict rests on the free signals, ten risk points are added for the unverified state, and mailbox_confidence is returned; GMX is not on the established-provider list, so that estimate depends on the username's shape and your own delivery data more than anything else. GMX has no consumer username rules in Spaw's rule set, so invalid_local_part does not apply. Catch-all does not occur on consumer GMX domains.
For unverified single lookups, pass callback_url so Spaw re-checks after 5 and 20 minutes; for lists, report delivery outcomes so confirmed mailboxes carry smtp_reason: delivered_recently on later lookups.
SPF and DMARC at GMX
Consumer GMX users have nothing to configure. The GMX domains publish their own SPF and DMARC records, and GMX enforces DMARC on inbound mail, so a message with a gmx.de From address sent through another service fails alignment. Spaw's dmarc_policy field shows the live policy for any domain; for gmx.net it reflects whatever GMX currently publishes.
Practical notes for sending to GMX users
GMX and WEB.DE together receive a large share of German consumer mail and are known for strict inbound policies: a valid reverse DNS entry for your sending IPs, aligned SPF and DKIM, and a working postmaster address are practical requirements, and 1&1 operates a postmaster programme with a certification for bulk senders. Plus-addressing is not a standard feature on consumer GMX accounts. Addresses on these domains are typically individuals, so role-word usernames are rare and reason: role is uncommon here.
For a live look at any GMX domain, run it through the free MX lookup and the SPF and DMARC checker.