Tuta, known as Tutanota until its 2023 rebrand, is an end-to-end encrypted mailbox service run by Tutao GmbH in Germany. It serves its own domains (tuta.com, tuta.io, tutanota.com, tutanota.de, tutamail.com, keemail.me) and custom domains on paid plans, all from infrastructure under the tutanota.de name. Spaw reports them as mx_provider: "tutanota".
How Tuta shows up in DNS
Every Tuta-hosted domain publishes a single MX record, mail.tutanota.de. Spaw matches the .tutanota.de suffix. Tuta is a mailbox host: the MX target is Tuta's own inbound server, which encrypts incoming mail for the recipient's key on arrival. mx_found is true and mx_implicit is false for a correctly configured domain.
How Tuta answers a verification handshake
Tuta typically rejects unknown recipients at RCPT TO, so a missing mailbox is confirmed in the session. Custom domains on Tuta can configure a catch-all address from the settings, and those domains answer as catch-all. Tuta's inbound server is conservative with unfamiliar sources, so occasional deferrals show up as smtp_reason: greylisted.
What that means for your verdicts
Most Tuta addresses come back deliverable with mailbox_exists: true or undeliverable with reason: mailbox_not_found and smtp_reason: no_mailbox. Custom domains with catch-all enabled answer risky with reason: catch_all; Spaw remembers the catch-all for seven days and returns mailbox_confidence, which without the established-provider bonus leans on the domain's own records, its age and the shape of the username. Tuta is not in the consumer username rule set, so invalid_local_part does not apply.
One point deserves care. Because Tuta offers free, anonymous, encrypted accounts, some disposable-domain lists include Tuta's public domains, and a lookup can then answer risky with reason: disposable for a real, long-lived mailbox. Spaw's disposable allowlist exists for exactly this kind of false positive; if you see Tuta's public domains flagged as disposable on your lists, treat the flag with suspicion and check the domain on the free disposable checker, which shows which list produced the match.
SPF and DMARC at Tuta
Tuta supports SPF, DKIM and DMARC on custom domains and shows the exact records to publish in its domain setup wizard; the SPF value in common use is v=spf1 include:spf.tutanota.de -all, and the wizard also provides the DKIM CNAME records and a suggested DMARC record. Tuta's own domains publish strict policies. Spaw reports the live state of a custom domain in has_spf and dmarc_policy.
Practical notes for sending to Tuta users
Tuta users chose an encrypted provider on purpose, and Tuta's spam filtering and its users' tolerance for marketing mail are both strict. Send only what was asked for, authenticate properly, and expect complaint-driven blocks to be quick. Tuta does not offer Gmail-style plus-addressing on its own domains; users create separate aliases instead, which look like ordinary addresses to a verifier and answer individually.
For a live look at any Tuta-hosted domain, run it through the free MX lookup and the SPF and DMARC checker.