Updated · Volt Ghost team
Two hosts behind every mail.com domain
Cloudflare's DNS-over-HTTPS resolver returned these records on 14 November 2026.
| Address domain | MX records | DMARC |
|---|---|---|
mail.com | 10 mx00.mail.com, 10 mx01.mail.com | quarantine |
email.com | same pair | quarantine |
usa.com | same pair | quarantine |
post.com | same pair | quarantine |
myself.com | same pair | quarantine |
consultant.com | same pair | quarantine |
mx00.mail.com resolved to 74.208.114.67 and mx01.mail.com to 74.208.114.68, two neighbouring IPv4 addresses with no IPv6. Team Cymru maps the 74.208.0.0/16 block to AS8560, IONOS SE, registered through ARIN in the US. Both records share priority 10, so there is no backup host: a sender that fails on one simply tries the other, the load-sharing layout iCloud's MX records also use. We checked six of mail.com's domains, not its whole catalogue, so a rarely used vanity domain could still differ. The MX lookup will tell you in seconds.
SPF, DMARC and transport security
| Record | Name | Value on 14 November |
|---|---|---|
| SPF | apex TXT on all six | v=spf1 redirect=_spf.mail.com |
| SPF list | _spf.mail.com | five a: hosts (mout.mail.com and others, two of them on 1and1.com) plus include:_spf.zimpel.de, ending ~all |
| DMARC | _dmarc.mail.com | p=quarantine, aggregate reports to [email protected] |
| MTA-STS | _mta-sts.mail.com | id=20180928194800Z; policy file mode: testing, both MX hosts, max_age: 604800 |
| TLS-RPT | _smtp._tls.mail.com | reports to [email protected] |
- One redirect, many domains: each vanity domain hands SPF to
_spf.mail.com, so the sending list is maintained in one place. - MTA-STS published since 2018, still testing: the policy ID dates from 28 September 2018, and the file still says
testing, so senders report TLS failures but deliver anyway. GMX was also in testing mode when we checked it; Tuta and Proton Mail enforce. - Shared roots with GMX and WEB.DE: the same
ns-gmx.ui-dnsname servers serve mail.com, gmx.com and gmx.net. WEB.DE's MX hosts are on the same IONOS network, AS8560.
Why the vanity domains matter
A form that allows only "known" providers can trip over mail.com users, because their addresses rarely say mail.com. Someone at @usa.com or @consultant.com is on the same mailbox service as @mail.com. Checking the MX host, not the domain name, is the reliable way to tell; on a lookup the hosts above are labelled mail.com by our email host lookup. Fastmail does something similar with many address domains; see the Fastmail MX records.
Unusual domain, not a throwaway one
Odd-looking domains are not a sign of temp mail on their own. Throwaway domains are flagged because they are on a public list, and many of them share a few receiving servers, as the 2026 disposable domains report counts. Some are simply old, known names: vomoto.com has been listed since 2015. mail.com's vanity domains point at mail.com's own hosts, so MX-based screening passes them. See how sites detect disposable email for the full set of checks, or test an address with the disposable email checker.
Questions
What is the MX record for mail.com?
mail.com has two MX records at equal priority 10: mx00.mail.com and mx01.mail.com. Senders pick either one, so the pair shares incoming mail.
Do email.com, usa.com and other mail.com domains use different servers?
Not in our check. email.com, usa.com, post.com, myself.com and consultant.com all listed mx00 and mx01.mail.com and used the same SPF redirect and DMARC policy as mail.com.
Is mail.com related to GMX?
Yes, at the DNS level. mail.com uses the same ns-gmx.ui-dns name servers as gmx.com and gmx.net, its TLS reports go to a 1und1.de mailbox, and its MX addresses sit on IONOS's network, all part of the same German group.
Is a mail.com address a disposable email?
No. mail.com accounts are ordinary long-term mailboxes, even on unusual-looking domains like usa.com. None of the six domains we checked is on the public disposable-domain list our checker uses.
