# Tuta (Tutanota): MX records and email verification

How Tuta-hosted domains look in DNS, how Tuta answers a verification handshake, and which verdicts to expect for tuta.com, tutanota.com and custom domains.

Updated: 2026-09-03

Tuta, known as Tutanota until its 2023 rebrand, is an end-to-end encrypted mailbox service run by Tutao GmbH in Germany. It serves its own domains (tuta.com, tuta.io, tutanota.com, tutanota.de, tutamail.com, keemail.me) and custom domains on paid plans, all from infrastructure under the `tutanota.de` name. Spaw reports them as `mx_provider: "tutanota"`.

## How Tuta shows up in DNS

Every Tuta-hosted domain publishes a single MX record, `mail.tutanota.de`. Spaw matches the `.tutanota.de` suffix. Tuta is a mailbox host: the MX target is Tuta's own inbound server, which encrypts incoming mail for the recipient's key on arrival. `mx_found` is true and `mx_implicit` is false for a correctly configured domain.

## How Tuta answers a verification handshake

Tuta typically rejects unknown recipients at `RCPT TO`, so a missing mailbox is confirmed in the session. Custom domains on Tuta can configure a catch-all address from the settings, and those domains answer as catch-all. Tuta's inbound server is conservative with unfamiliar sources, so occasional deferrals show up as `smtp_reason: greylisted`.

## What that means for your verdicts

Most Tuta addresses come back `deliverable` with `mailbox_exists: true` or `undeliverable` with `reason: mailbox_not_found` and `smtp_reason: no_mailbox`. Custom domains with catch-all enabled answer `risky` with `reason: catch_all`; Spaw remembers the catch-all for seven days and returns `mailbox_confidence`, which without the established-provider bonus leans on the domain's own records, its age and the shape of the username. Tuta is not in the consumer username rule set, so `invalid_local_part` does not apply.

One point deserves care. Because Tuta offers free, anonymous, encrypted accounts, some disposable-domain lists include Tuta's public domains, and a lookup can then answer `risky` with `reason: disposable` for a real, long-lived mailbox. Spaw's disposable allowlist exists for exactly this kind of false positive; if you see Tuta's public domains flagged as disposable on your lists, treat the flag with suspicion and check the domain on the free disposable checker, which shows which list produced the match.

## SPF and DMARC at Tuta

Tuta supports SPF, DKIM and DMARC on custom domains and shows the exact records to publish in its domain setup wizard; the SPF value in common use is `v=spf1 include:spf.tutanota.de -all`, and the wizard also provides the DKIM CNAME records and a suggested DMARC record. Tuta's own domains publish strict policies. Spaw reports the live state of a custom domain in `has_spf` and `dmarc_policy`.

## Practical notes for sending to Tuta users

Tuta users chose an encrypted provider on purpose, and Tuta's spam filtering and its users' tolerance for marketing mail are both strict. Send only what was asked for, authenticate properly, and expect complaint-driven blocks to be quick. Tuta does not offer Gmail-style plus-addressing on its own domains; users create separate aliases instead, which look like ordinary addresses to a verifier and answer individually.

For a live look at any Tuta-hosted domain, run it through the free MX lookup and the SPF and DMARC checker.

Reference: https://spaw.co/email-providers/tutanota