Updated · Volt Ghost team
web.de MX records
Fetched on 12 November 2026 from Cloudflare's DoH resolver.
| Priority | Mail server (MX host) | IPv4 address |
|---|---|---|
| 100 | mx-ha02.web.de | 212.227.15.138 |
| 100 | mx-ha03.web.de | 212.227.15.154 |
Both hosts carry the same priority, so neither is a backup: senders pick between them, the same pattern iCloud's MX records use. The number 100 itself doesn't matter, only how it compares with the other records. Both addresses sit in 212.227.0.0/16, which Team Cymru's IP-to-ASN data maps to AS8560, IONOS SE in Germany. Neither host returned an IPv6 address.
SPF, DMARC and MTA-STS for web.de
| Type | Lookup name | Result on 12 November 2026 |
|---|---|---|
| SPF | web.de TXT | v=spf1 redirect=_spf.web.de |
| SPF list | _spf.web.de TXT | a:mout.web.de a:mout-xforward.web.de a:mout-bounce.web.de a:mout-csbulk.1and1.com a:mout-cscorp.1and1.com ~all |
| DMARC | _dmarc.web.de | p=quarantine, aggregate reports to [email protected] |
| MTA-STS | _mta-sts.web.de and its HTTPS policy | mode: testing, cached for 604,800 seconds (7 days) |
| TLS-RPT | _smtp._tls.web.de | reports to [email protected] |
- SPF by host name, soft fail: the list names outgoing
moutservers by their A records rather than IP ranges, and ends in~all, so a failing message is marked suspicious rather than refused outright by SPF alone. - Spoofed web.de mail goes to spam: with
p=quarantine, receivers are asked to junk messages that fail alignment, matching the policy at GMX. - MTA-STS ID from 2018: the TXT record's
id=20180928194800Zsuggests the policy has not changed since September 2018, and it still says testing.
WEB.DE next to GMX
WEB.DE and GMX share an owner, and their DNS shows it: the same TLS-report mailbox at 1und1.de, 1and1.com hosts in SPF, and the same DMARC policy. The differences matter when you debug delivery. WEB.DE uses priority 100 where GMX uses 10, and its hosts are named mx-ha0X.web.de, not mx0X.gmx.net. A filter that only knows GMX's host names won't recognise WEB.DE's. Our email host lookup labels both as GMX / WEB.DE.
Does a web.de address count as disposable?
No. web.de is a common consumer address in Germany, and screening tools treat it as an ordinary consumer mailbox because mx-ha02 and mx-ha03 are WEB.DE's own servers. Where a site does refuse an address, the reasons are usually the ones in how sites detect disposable email. To see whether a particular domain is on the throwaway list, use the disposable email checker.
Questions
What is the MX record for web.de?
web.de has two MX records, mx-ha02.web.de and mx-ha03.web.de, both at priority 100, so sending servers share mail between them.
Are WEB.DE and GMX the same mail system?
They are sister brands. Both send TLS reports to the same 1und1.de address and their SPF lists both name 1and1.com hosts, but WEB.DE receives on its own web.de host names, not on the gmx.net servers.
Does WEB.DE use MTA-STS?
Yes, but in testing mode on 12 November 2026. The policy lists mx-ha02.web.de and mx-ha03.web.de, and senders keep delivering even if TLS can't be verified; they just file a report.
Is web.de a throwaway address?
No. web.de belongs to a long-running German free mail service and is missing from the community list of throwaway domains that our checker reads.
