{ "schema_version": 2, "version": "1.6.0", "maintainer": "ThreatScope Check", "providers": [ { "id": "activecampaign", "name": "ActiveCampaign" }, { "id": "akamai", "name": "Akamai" }, { "id": "amazon", "name": "Amazon Web Services" }, { "id": "apple", "name": "Apple" }, { "id": "atlassian", "name": "Atlassian" }, { "id": "broadcom", "name": "Broadcom" }, { "id": "campaign-monitor", "name": "Campaign Monitor" }, { "id": "cisco", "name": "Cisco" }, { "id": "cloudflare", "name": "Cloudflare" }, { "id": "cloudns", "name": "ClouDNS" }, { "id": "crazy-domains", "name": "Crazy Domains" }, { "id": "ddns", "name": "Discount Domain Name Services" }, { "id": "digitalocean", "name": "DigitalOcean" }, { "id": "dns-made-easy", "name": "DNS Made Easy" }, { "id": "dnsimple", "name": "DNSimple" }, { "id": "exclaimer", "name": "Exclaimer" }, { "id": "fastmail", "name": "Fastmail" }, { "id": "freshworks", "name": "Freshworks" }, { "id": "gandi", "name": "Gandi" }, { "id": "godaddy", "name": "GoDaddy" }, { "id": "google", "name": "Google" }, { "id": "hetzner", "name": "Hetzner" }, { "id": "hostinger", "name": "Hostinger" }, { "id": "ionos", "name": "IONOS" }, { "id": "mailchimp", "name": "Mailchimp" }, { "id": "mailgun", "name": "Mailgun" }, { "id": "microsoft", "name": "Microsoft" }, { "id": "mimecast", "name": "Mimecast" }, { "id": "namecheap", "name": "Namecheap" }, { "id": "postmark", "name": "Postmark" }, { "id": "proofpoint", "name": "Proofpoint" }, { "id": "proton", "name": "Proton" }, { "id": "rackspace", "name": "Rackspace" }, { "id": "salesforce", "name": "Salesforce" }, { "id": "securence", "name": "Securence" }, { "id": "shopify", "name": "Shopify" }, { "id": "sophos", "name": "Sophos" }, { "id": "titan", "name": "Titan" }, { "id": "tpp-wholesale", "name": "TPP Wholesale" }, { "id": "twilio-sendgrid", "name": "Twilio SendGrid" }, { "id": "ultradns", "name": "UltraDNS" }, { "id": "ventraip", "name": "VentraIP" }, { "id": "wix", "name": "Wix" }, { "id": "wordpress-com", "name": "WordPress.com" }, { "id": "zendesk", "name": "Zendesk" }, { "id": "zoho", "name": "Zoho" }, { "id": "zoneedit", "name": "ZoneEdit" }, { "id": "atmail", "name": "Atmail" }, { "id": "squarespace", "name": "Squarespace" }, { "id": "telstra", "name": "Telstra" }, { "id": "trellix", "name": "Trellix" }, { "id": "webcentral", "name": "Webcentral" }, { "id": "digital-pacific", "name": "Digital Pacific" }, { "id": "micron21", "name": "Micron21" }, { "id": "crucial", "name": "Crucial" }, { "id": "conetix", "name": "Conetix" }, { "id": "dreamit-host", "name": "DreamIT Host" }, { "id": "panthur", "name": "Panthur" }, { "id": "synergy-wholesale", "name": "Synergy Wholesale" }, { "id": "obble", "name": "Obble Hosting" }, { "id": "sap", "name": "SAP" }, { "id": "hubspot", "name": "HubSpot" }, { "id": "qualtrics", "name": "Qualtrics" }, { "id": "oracle", "name": "Oracle" }, { "id": "swift-digital", "name": "Swift Digital" }, { "id": "servicenow", "name": "ServiceNow" }, { "id": "knowbe4", "name": "KnowBe4" }, { "id": "formassembly", "name": "FormAssembly" }, { "id": "help-scout", "name": "Help Scout" }, { "id": "adobe", "name": "Adobe" }, { "id": "red-sift", "name": "Red Sift" }, { "id": "powerdmarc", "name": "PowerDMARC" }, { "id": "valimail", "name": "Valimail" }, { "id": "alchemer", "name": "Alchemer" }, { "id": "check-point", "name": "Check Point" }, { "id": "clicksend", "name": "ClickSend" }, { "id": "codetwo", "name": "CodeTwo" }, { "id": "easydmarc", "name": "EasyDMARC" }, { "id": "elastic-email", "name": "Elastic Email" }, { "id": "mailerlite", "name": "MailerLite" }, { "id": "ortto", "name": "Ortto" }, { "id": "raisely", "name": "Raisely" }, { "id": "sendmarc", "name": "Sendmarc" }, { "id": "csc", "name": "CSC" } ], "rules": [ { "id": "activecampaign-spf", "provider_id": "activecampaign", "service": "Campaign email SPF", "role": "spf_reference", "match_type": "exact", "patterns": [ "emsd1.com" ], "status": "active", "source": { "url": "https://help.activecampaign.com/hc/es/articles/13063110494364-Cómo-fusionar-o-actualizar-registros-SPF-existentes", "title": "How to merge or update existing SPF records", "basis": "ActiveCampaign’s support article identifies include:emsd1.com for manually maintained SPF records.", "reviewed_on": "2026-09-06", "review_due": "2027-03-06" }, "fixtures": { "positive": [ "emsd1.com" ], "negative": [ "x.emsd1.com", "emsd1.com.example.org" ] }, "evidence_basis": "provider_documented_pattern" }, { "id": "akamai-edge-dns-ns", "provider_id": "akamai", "service": "Edge DNS", "role": "dns_hosting", "match_type": "hostname_suffix", "patterns": [ "akam.net" ], "status": "active", "source": { "url": "https://www.akamai.com/blog/edge/edge-dns-secondary-implementation-order-of-operations-for-ns-zone", "title": "Edge DNS Secondary Implementation: Order of Operations", "basis": "Akamai documents akam.net nameservers in primary and mixed delegation examples.", "reviewed_on": "2026-09-06", "review_due": "2027-03-06" }, "fixtures": { "positive": [ "a12-65.akam.net." ], "negative": [ "akam.net", "a12-65.akam.net.example.org", "notakam.net" ] }, "evidence_basis": "provider_documented_pattern" }, { "id": "akamai-linode-ns", "provider_id": "akamai", "service": "Linode DNS Manager", "role": "dns_hosting", "match_type": "exact", "patterns": [ "ns1.linode.com", "ns2.linode.com", "ns3.linode.com", "ns4.linode.com", "ns5.linode.com" ], "status": "active", "source": { "url": "https://techdocs.akamai.com/cloud-computing/docs/getting-started-with-dns-manager", "title": "Getting started with DNS manager", "basis": "Akamai documents ns1 through ns5.linode.com for Linode DNS Manager; the stable Akamai provider ID retains the distinct service name.", "reviewed_on": "2026-09-06", "review_due": "2027-03-06" }, "fixtures": { "positive": [ "ns1.linode.com", "ns2.linode.com", "ns3.linode.com", "ns4.linode.com", "ns5.linode.com" ], "negative": [ "x.ns1.linode.com", "ns1.linode.com.example.org" ] }, "evidence_basis": "provider_documented_pattern" }, { "id": "amazon-route53-ns", "provider_id": "amazon", "service": "Route 53", "role": "dns_hosting", "match_type": "hostname_suffix", "patterns": [ "awsdns-00.com", "awsdns-01.com", "awsdns-02.com", "awsdns-03.com", "awsdns-04.com", "awsdns-05.com", "awsdns-06.com", "awsdns-07.com", "awsdns-08.com", "awsdns-09.com", "awsdns-10.com", "awsdns-11.com", "awsdns-12.com", "awsdns-13.com", "awsdns-14.com", "awsdns-15.com", "awsdns-16.com", "awsdns-17.com", "awsdns-18.com", "awsdns-19.com", "awsdns-20.com", "awsdns-21.com", "awsdns-22.com", "awsdns-23.com", "awsdns-24.com", "awsdns-25.com", "awsdns-26.com", "awsdns-27.com", "awsdns-28.com", "awsdns-29.com", "awsdns-30.com", "awsdns-31.com", "awsdns-32.com", "awsdns-33.com", "awsdns-34.com", "awsdns-35.com", "awsdns-36.com", "awsdns-37.com", "awsdns-38.com", "awsdns-39.com", "awsdns-40.com", "awsdns-41.com", "awsdns-42.com", "awsdns-43.com", "awsdns-44.com", "awsdns-45.com", "awsdns-46.com", "awsdns-47.com", "awsdns-48.com", "awsdns-49.com", "awsdns-50.com", "awsdns-51.com", "awsdns-52.com", "awsdns-53.com", "awsdns-54.com", "awsdns-55.com", "awsdns-56.com", "awsdns-57.com", "awsdns-58.com", "awsdns-59.com", "awsdns-60.com", "awsdns-61.com", "awsdns-62.com", "awsdns-63.com", "awsdns-00.net", "awsdns-01.net", "awsdns-02.net", "awsdns-03.net", "awsdns-04.net", "awsdns-05.net", "awsdns-06.net", "awsdns-07.net", "awsdns-08.net", "awsdns-09.net", "awsdns-10.net", "awsdns-11.net", "awsdns-12.net", "awsdns-13.net", "awsdns-14.net", "awsdns-15.net", "awsdns-16.net", "awsdns-17.net", "awsdns-18.net", "awsdns-19.net", "awsdns-20.net", "awsdns-21.net", "awsdns-22.net", "awsdns-23.net", "awsdns-24.net", "awsdns-25.net", "awsdns-26.net", "awsdns-27.net", "awsdns-28.net", "awsdns-29.net", "awsdns-30.net", "awsdns-31.net", "awsdns-32.net", "awsdns-33.net", "awsdns-34.net", "awsdns-35.net", "awsdns-36.net", "awsdns-37.net", "awsdns-38.net", "awsdns-39.net", "awsdns-40.net", "awsdns-41.net", "awsdns-42.net", "awsdns-43.net", "awsdns-44.net", "awsdns-45.net", "awsdns-46.net", "awsdns-47.net", "awsdns-48.net", "awsdns-49.net", "awsdns-50.net", "awsdns-51.net", "awsdns-52.net", "awsdns-53.net", "awsdns-54.net", "awsdns-55.net", "awsdns-56.net", "awsdns-57.net", "awsdns-58.net", "awsdns-59.net", "awsdns-60.net", "awsdns-61.net", "awsdns-62.net", "awsdns-63.net", "awsdns-00.org", "awsdns-01.org", "awsdns-02.org", "awsdns-03.org", "awsdns-04.org", "awsdns-05.org", "awsdns-06.org", "awsdns-07.org", "awsdns-08.org", "awsdns-09.org", "awsdns-10.org", "awsdns-11.org", "awsdns-12.org", "awsdns-13.org", "awsdns-14.org", "awsdns-15.org", "awsdns-16.org", "awsdns-17.org", "awsdns-18.org", "awsdns-19.org", "awsdns-20.org", "awsdns-21.org", "awsdns-22.org", "awsdns-23.org", "awsdns-24.org", "awsdns-25.org", "awsdns-26.org", "awsdns-27.org", "awsdns-28.org", "awsdns-29.org", "awsdns-30.org", "awsdns-31.org", "awsdns-32.org", "awsdns-33.org", "awsdns-34.org", "awsdns-35.org", "awsdns-36.org", "awsdns-37.org", "awsdns-38.org", "awsdns-39.org", "awsdns-40.org", "awsdns-41.org", "awsdns-42.org", "awsdns-43.org", "awsdns-44.org", "awsdns-45.org", "awsdns-46.org", "awsdns-47.org", "awsdns-48.org", "awsdns-49.org", "awsdns-50.org", "awsdns-51.org", "awsdns-52.org", "awsdns-53.org", "awsdns-54.org", "awsdns-55.org", "awsdns-56.org", "awsdns-57.org", "awsdns-58.org", "awsdns-59.org", "awsdns-60.org", "awsdns-61.org", "awsdns-62.org", "awsdns-63.org", "awsdns-00.co.uk", "awsdns-01.co.uk", "awsdns-02.co.uk", "awsdns-03.co.uk", "awsdns-04.co.uk", "awsdns-05.co.uk", "awsdns-06.co.uk", "awsdns-07.co.uk", "awsdns-08.co.uk", "awsdns-09.co.uk", "awsdns-10.co.uk", "awsdns-11.co.uk", "awsdns-12.co.uk", "awsdns-13.co.uk", "awsdns-14.co.uk", "awsdns-15.co.uk", "awsdns-16.co.uk", "awsdns-17.co.uk", "awsdns-18.co.uk", "awsdns-19.co.uk", "awsdns-20.co.uk", "awsdns-21.co.uk", "awsdns-22.co.uk", "awsdns-23.co.uk", "awsdns-24.co.uk", "awsdns-25.co.uk", "awsdns-26.co.uk", "awsdns-27.co.uk", "awsdns-28.co.uk", "awsdns-29.co.uk", "awsdns-30.co.uk", "awsdns-31.co.uk", "awsdns-32.co.uk", "awsdns-33.co.uk", "awsdns-34.co.uk", "awsdns-35.co.uk", "awsdns-36.co.uk", "awsdns-37.co.uk", "awsdns-38.co.uk", "awsdns-39.co.uk", "awsdns-40.co.uk", "awsdns-41.co.uk", "awsdns-42.co.uk", "awsdns-43.co.uk", "awsdns-44.co.uk", "awsdns-45.co.uk", "awsdns-46.co.uk", "awsdns-47.co.uk", "awsdns-48.co.uk", "awsdns-49.co.uk", "awsdns-50.co.uk", "awsdns-51.co.uk", "awsdns-52.co.uk", "awsdns-53.co.uk", "awsdns-54.co.uk", "awsdns-55.co.uk", "awsdns-56.co.uk", "awsdns-57.co.uk", "awsdns-58.co.uk", "awsdns-59.co.uk", "awsdns-60.co.uk", "awsdns-61.co.uk", "awsdns-62.co.uk", "awsdns-63.co.uk" ], "status": "active", "source": { "url": "https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/SOA-NSrecords.html", "title": "NS and SOA records that Amazon Route 53 creates for a public hosted zone", "basis": "AWS documents the awsdns-number nameserver family across com, net, org and co.uk. This release pins a finite 00–63 shard allowlist, including the shards observed in the pinned .auDO sample; it does not match arbitrary awsdns substrings or future shards.", "reviewed_on": "2026-09-06", "review_due": "2027-03-06" }, "fixtures": { "positive": [ "ns1.awsdns-00.com", "ns1.awsdns-01.com", "ns1.awsdns-02.com", "ns1.awsdns-03.com", "ns1.awsdns-04.com", "ns1.awsdns-05.com", "ns1.awsdns-06.com", "ns1.awsdns-07.com", "ns1.awsdns-08.com", "ns1.awsdns-09.com", "ns1.awsdns-10.com", "ns1.awsdns-11.com", "ns1.awsdns-12.com", "ns1.awsdns-13.com", "ns1.awsdns-14.com", "ns1.awsdns-15.com", "ns1.awsdns-16.com", "ns1.awsdns-17.com", "ns1.awsdns-18.com", "ns1.awsdns-19.com", "ns1.awsdns-20.com", "ns1.awsdns-21.com", "ns1.awsdns-22.com", "ns1.awsdns-23.com", "ns1.awsdns-24.com", "ns1.awsdns-25.com", "ns1.awsdns-26.com", "ns1.awsdns-27.com", "ns1.awsdns-28.com", "ns1.awsdns-29.com", "ns1.awsdns-30.com", "ns1.awsdns-31.com", "ns1.awsdns-32.com", "ns1.awsdns-33.com", "ns1.awsdns-34.com", "ns1.awsdns-35.com", "ns1.awsdns-36.com", "ns1.awsdns-37.com", "ns1.awsdns-38.com", "ns1.awsdns-39.com", "ns1.awsdns-40.com", "ns1.awsdns-41.com", "ns1.awsdns-42.com", "ns1.awsdns-43.com", "ns1.awsdns-44.com", "ns1.awsdns-45.com", "ns1.awsdns-46.com", "ns1.awsdns-47.com", "ns1.awsdns-48.com", "ns1.awsdns-49.com", "ns1.awsdns-50.com", "ns1.awsdns-51.com", "ns1.awsdns-52.com", "ns1.awsdns-53.com", "ns1.awsdns-54.com", "ns1.awsdns-55.com", "ns1.awsdns-56.com", "ns1.awsdns-57.com", "ns1.awsdns-58.com", "ns1.awsdns-59.com", "ns1.awsdns-60.com", "ns1.awsdns-61.com", "ns1.awsdns-62.com", "ns1.awsdns-63.com", "ns1.awsdns-00.net", "ns1.awsdns-01.net", "ns1.awsdns-02.net", "ns1.awsdns-03.net", "ns1.awsdns-04.net", "ns1.awsdns-05.net", "ns1.awsdns-06.net", "ns1.awsdns-07.net", "ns1.awsdns-08.net", "ns1.awsdns-09.net", "ns1.awsdns-10.net", "ns1.awsdns-11.net", "ns1.awsdns-12.net", "ns1.awsdns-13.net", "ns1.awsdns-14.net", "ns1.awsdns-15.net", "ns1.awsdns-16.net", "ns1.awsdns-17.net", "ns1.awsdns-18.net", "ns1.awsdns-19.net", "ns1.awsdns-20.net", "ns1.awsdns-21.net", "ns1.awsdns-22.net", "ns1.awsdns-23.net", "ns1.awsdns-24.net", "ns1.awsdns-25.net", "ns1.awsdns-26.net", "ns1.awsdns-27.net", "ns1.awsdns-28.net", "ns1.awsdns-29.net", "ns1.awsdns-30.net", "ns1.awsdns-31.net", "ns1.awsdns-32.net", "ns1.awsdns-33.net", "ns1.awsdns-34.net", "ns1.awsdns-35.net", "ns1.awsdns-36.net", "ns1.awsdns-37.net", "ns1.awsdns-38.net", "ns1.awsdns-39.net", "ns1.awsdns-40.net", "ns1.awsdns-41.net", "ns1.awsdns-42.net", "ns1.awsdns-43.net", "ns1.awsdns-44.net", "ns1.awsdns-45.net", "ns1.awsdns-46.net", "ns1.awsdns-47.net", "ns1.awsdns-48.net", "ns1.awsdns-49.net", "ns1.awsdns-50.net", "ns1.awsdns-51.net", "ns1.awsdns-52.net", "ns1.awsdns-53.net", "ns1.awsdns-54.net", "ns1.awsdns-55.net", "ns1.awsdns-56.net", "ns1.awsdns-57.net", "ns1.awsdns-58.net", "ns1.awsdns-59.net", "ns1.awsdns-60.net", "ns1.awsdns-61.net", "ns1.awsdns-62.net", "ns1.awsdns-63.net", "ns1.awsdns-00.org", "ns1.awsdns-01.org", "ns1.awsdns-02.org", "ns1.awsdns-03.org", "ns1.awsdns-04.org", "ns1.awsdns-05.org", "ns1.awsdns-06.org", "ns1.awsdns-07.org", "ns1.awsdns-08.org", "ns1.awsdns-09.org", "ns1.awsdns-10.org", "ns1.awsdns-11.org", "ns1.awsdns-12.org", "ns1.awsdns-13.org", "ns1.awsdns-14.org", "ns1.awsdns-15.org", "ns1.awsdns-16.org", "ns1.awsdns-17.org", "ns1.awsdns-18.org", "ns1.awsdns-19.org", "ns1.awsdns-20.org", "ns1.awsdns-21.org", "ns1.awsdns-22.org", "ns1.awsdns-23.org", "ns1.awsdns-24.org", "ns1.awsdns-25.org", "ns1.awsdns-26.org", "ns1.awsdns-27.org", "ns1.awsdns-28.org", "ns1.awsdns-29.org", "ns1.awsdns-30.org", "ns1.awsdns-31.org", "ns1.awsdns-32.org", "ns1.awsdns-33.org", "ns1.awsdns-34.org", "ns1.awsdns-35.org", "ns1.awsdns-36.org", "ns1.awsdns-37.org", "ns1.awsdns-38.org", "ns1.awsdns-39.org", "ns1.awsdns-40.org", "ns1.awsdns-41.org", "ns1.awsdns-42.org", "ns1.awsdns-43.org", "ns1.awsdns-44.org", "ns1.awsdns-45.org", "ns1.awsdns-46.org", "ns1.awsdns-47.org", "ns1.awsdns-48.org", "ns1.awsdns-49.org", "ns1.awsdns-50.org", "ns1.awsdns-51.org", "ns1.awsdns-52.org", "ns1.awsdns-53.org", "ns1.awsdns-54.org", "ns1.awsdns-55.org", "ns1.awsdns-56.org", "ns1.awsdns-57.org", "ns1.awsdns-58.org", "ns1.awsdns-59.org", "ns1.awsdns-60.org", "ns1.awsdns-61.org", "ns1.awsdns-62.org", "ns1.awsdns-63.org", "ns1.awsdns-00.co.uk", "ns1.awsdns-01.co.uk", "ns1.awsdns-02.co.uk", "ns1.awsdns-03.co.uk", "ns1.awsdns-04.co.uk", "ns1.awsdns-05.co.uk", "ns1.awsdns-06.co.uk", "ns1.awsdns-07.co.uk", "ns1.awsdns-08.co.uk", "ns1.awsdns-09.co.uk", "ns1.awsdns-10.co.uk", "ns1.awsdns-11.co.uk", "ns1.awsdns-12.co.uk", "ns1.awsdns-13.co.uk", "ns1.awsdns-14.co.uk", "ns1.awsdns-15.co.uk", "ns1.awsdns-16.co.uk", "ns1.awsdns-17.co.uk", "ns1.awsdns-18.co.uk", "ns1.awsdns-19.co.uk", "ns1.awsdns-20.co.uk", "ns1.awsdns-21.co.uk", "ns1.awsdns-22.co.uk", "ns1.awsdns-23.co.uk", "ns1.awsdns-24.co.uk", "ns1.awsdns-25.co.uk", "ns1.awsdns-26.co.uk", "ns1.awsdns-27.co.uk", "ns1.awsdns-28.co.uk", "ns1.awsdns-29.co.uk", "ns1.awsdns-30.co.uk", "ns1.awsdns-31.co.uk", "ns1.awsdns-32.co.uk", "ns1.awsdns-33.co.uk", "ns1.awsdns-34.co.uk", "ns1.awsdns-35.co.uk", "ns1.awsdns-36.co.uk", "ns1.awsdns-37.co.uk", "ns1.awsdns-38.co.uk", "ns1.awsdns-39.co.uk", "ns1.awsdns-40.co.uk", "ns1.awsdns-41.co.uk", "ns1.awsdns-42.co.uk", "ns1.awsdns-43.co.uk", "ns1.awsdns-44.co.uk", "ns1.awsdns-45.co.uk", "ns1.awsdns-46.co.uk", "ns1.awsdns-47.co.uk", "ns1.awsdns-48.co.uk", "ns1.awsdns-49.co.uk", "ns1.awsdns-50.co.uk", "ns1.awsdns-51.co.uk", "ns1.awsdns-52.co.uk", "ns1.awsdns-53.co.uk", "ns1.awsdns-54.co.uk", "ns1.awsdns-55.co.uk", "ns1.awsdns-56.co.uk", "ns1.awsdns-57.co.uk", "ns1.awsdns-58.co.uk", "ns1.awsdns-59.co.uk", "ns1.awsdns-60.co.uk", "ns1.awsdns-61.co.uk", "ns1.awsdns-62.co.uk", "ns1.awsdns-63.co.uk" ], "negative": [ "ns-1.awsdns-64.com", "ns-1.awsdns-1.com", "ns-1.awsdns-01.example.org", "awsdns-01.com", "ns-1.awsdns-01.com.example.org" ] }, "evidence_basis": "provider_documented_pattern" }, { "id": "amazon-ses-spf", "provider_id": "amazon", "service": "SES SPF", "role": "spf_reference", "match_type": "exact", "patterns": [ "amazonses.com" ], "status": "active", "source": { "url": "https://docs.aws.amazon.com/ses/latest/dg/vdm-advisor.html", "title": "Virtual Deliverability Manager advisor", "basis": "The SES advisor documents include:amazonses.com for custom MAIL FROM SPF. Presence at another owner name does not establish alignment or actual use.", "reviewed_on": "2026-09-06", "review_due": "2027-03-06" }, "fixtures": { "positive": [ "amazonses.com" ], "negative": [ "x.amazonses.com", "amazonses.com.example.org" ] }, "evidence_basis": "provider_documented_pattern" }, { "id": "apple-icloud-mx", "provider_id": "apple", "service": "iCloud Mail routing", "role": "inbound_mail", "match_type": "exact", "patterns": [ "mx01.mail.icloud.com", "mx02.mail.icloud.com" ], "status": "active", "source": { "url": "https://support.apple.com/en-us/102374", "title": "Set up an existing domain with iCloud Mail", "basis": "Apple’s custom-domain setup documents these two iCloud Mail MX records.", "reviewed_on": "2026-09-06", "review_due": "2027-03-06" }, "fixtures": { "positive": [ "mx01.mail.icloud.com", "mx02.mail.icloud.com" ], "negative": [ "x.mx01.mail.icloud.com", "mx01.mail.icloud.com.example.org" ] }, "evidence_basis": "provider_documented_pattern" }, { "id": "apple-icloud-spf", "provider_id": "apple", "service": "iCloud Mail SPF", "role": "spf_reference", "match_type": "exact", "patterns": [ "icloud.com" ], "status": "active", "source": { "url": "https://support.apple.com/en-us/102374", "title": "Set up an existing domain with iCloud Mail", "basis": "Apple documents include:icloud.com for custom-domain mail SPF.", "reviewed_on": "2026-09-06", "review_due": "2027-03-06" }, "fixtures": { "positive": [ "icloud.com" ], "negative": [ "x.icloud.com", "icloud.com.example.org" ] }, "evidence_basis": "provider_documented_pattern" }, { "id": "atlassian-spf", "provider_id": "atlassian", "service": "Cloud notifications SPF", "role": "spf_reference", "match_type": "exact", "patterns": [ "_spf.atlassian.net" ], "status": "active", "source": { "url": "https://support.atlassian.com/jira/kb/why-dns-checker-for-setting-up-custom-domain-email-address-still-unverified-in-cloud/", "title": "Troubleshoot Unverified DNS Checker for Custom Domain Email", "basis": "Atlassian documents _spf.atlassian.net as the default SPF include for custom-domain email.", "reviewed_on": "2026-09-06", "review_due": "2027-03-06" }, "fixtures": { "positive": [ "_spf.atlassian.net" ], "negative": [ "x._spf.atlassian.net", "_spf.atlassian.net.example.org" ] }, "evidence_basis": "provider_documented_pattern" }, { "id": "campaign-monitor-spf", "provider_id": "campaign-monitor", "service": "Campaign email SPF reference", "role": "spf_reference", "match_type": "exact", "patterns": [ "_spf.createsend.com" ], "status": "active", "source": { "url": "https://help.campaignmonitor.com/articles/Knowledge/allowlist-campaign-monitors-addresses", "title": "Allowlist Campaign Monitor’s addresses", "basis": "Campaign Monitor documents _spf.createsend.com for systems that require an explicit SPF reference; it also explains that SPF is normally handled by the service.", "reviewed_on": "2026-09-06", "review_due": "2027-03-06" }, "fixtures": { "positive": [ "_spf.createsend.com" ], "negative": [ "x._spf.createsend.com", "_spf.createsend.com.example.org" ] }, "evidence_basis": "provider_documented_pattern" }, { "id": "cisco-secure-email-mx", "provider_id": "cisco", "service": "Secure Email Cloud Gateway", "role": "inbound_mail", "match_type": "hostname_suffix", "patterns": [ "iphmx.com" ], "status": "active", "source": { "url": "https://docs.ces.cisco.com/docs/hostnames", "title": "DNS Records, Hostnames & IP Addresses", "basis": "Cisco documents allocation-specific and regional MX endpoints below iphmx.com.", "reviewed_on": "2026-09-06", "review_due": "2027-03-06" }, "fixtures": { "positive": [ "mx1.hc1038-58.ap.iphmx.com" ], "negative": [ "iphmx.com", "notiphmx.com", "mx1.hc1038-58.ap.iphmx.com.example.org" ] }, "evidence_basis": "provider_documented_pattern" }, { "id": "cloudflare-authoritative-ns", "provider_id": "cloudflare", "service": "Authoritative DNS", "role": "dns_hosting", "match_type": "hostname_suffix", "patterns": [ "ns.cloudflare.com", "foundationdns.com", "foundationdns.net", "foundationdns.org" ], "status": "active", "source": { "url": "https://developers.cloudflare.com/dns/nameservers/", "title": "Cloudflare nameservers", "basis": "Cloudflare documents standard ns.cloudflare.com and Foundation DNS nameserver namespaces; custom nameservers use customer domains.", "reviewed_on": "2026-09-06", "review_due": "2027-03-06" }, "fixtures": { "positive": [ "ALICE.NS.CLOUDFLARE.COM.", "blue.foundationdns.com", "blue.foundationdns.net", "blue.foundationdns.org" ], "negative": [ "ns.cloudflare.com", "cloudflare.customer.example", "alice.ns.cloudflare.com.example.org", "notfoundationdns.com" ] }, "evidence_basis": "provider_documented_pattern" }, { "id": "cloudns-ns", "provider_id": "cloudns", "service": "Authoritative DNS", "role": "dns_hosting", "match_type": "hostname_suffix", "patterns": [ "cloudns.net" ], "status": "active", "source": { "url": "https://www.cloudns.net/wiki/article/355/", "title": "Getting Started with ClouDNS", "basis": "ClouDNS documents cloudns.net nameservers for delegation, including pns31 through pns34. Other branded or white-label namespaces need their own rule.", "reviewed_on": "2026-09-06", "review_due": "2027-03-06" }, "fixtures": { "positive": [ "pns31.cloudns.net" ], "negative": [ "cloudns.net", "notcloudns.net", "pns31.cloudns.net.example.org" ] }, "evidence_basis": "provider_documented_pattern" }, { "id": "crazy-domains-ns", "provider_id": "crazy-domains", "service": "Domain and hosting DNS", "role": "dns_hosting", "match_type": "exact", "patterns": [ "ns1.crazydomains.com", "ns2.crazydomains.com", "ns1.dnspackage.com", "ns2.dnspackage.com", "ns1.syrahost.com", "ns2.syrahost.com" ], "status": "active", "source": { "url": "https://www.crazydomains.com/help/article/what-name-server-should-i-use", "title": "What Name Server Should I Use", "basis": "Crazy Domains documents the account-manager, premium and hosting DNS pairs, including the Syrahost namespace used by .auDO.", "reviewed_on": "2026-09-06", "review_due": "2027-03-06" }, "fixtures": { "positive": [ "ns1.crazydomains.com", "ns2.crazydomains.com", "ns1.dnspackage.com", "ns2.dnspackage.com", "ns1.syrahost.com", "ns2.syrahost.com" ], "negative": [ "x.ns1.crazydomains.com", "ns1.crazydomains.com.example.org" ] }, "evidence_basis": "provider_documented_pattern" }, { "id": "ddns-quick-ns", "provider_id": "ddns", "service": "Quick DNS", "role": "dns_hosting", "match_type": "exact", "patterns": [ "dns1.quick.net.au", "dns2.quick.net.au", "dns3.quick.net.au", "dns4.quick.net.au" ], "status": "active", "source": { "url": "https://www.ddns.com.au/faq/288/What-Are-Name-Servers-And-How-Do-I-Change-Them.html", "title": "What Are Nameservers And How Do I Change Them?", "basis": "DDNS explicitly publishes these four quick.net.au nameservers for its DNS hosting service. This refines .auDO’s QuickInternet / QuickDNS category using the provider’s own documentation.", "reviewed_on": "2026-09-06", "review_due": "2027-03-06" }, "fixtures": { "positive": [ "dns1.quick.net.au", "dns2.quick.net.au", "dns3.quick.net.au", "dns4.quick.net.au" ], "negative": [ "x.dns1.quick.net.au", "dns1.quick.net.au.example.org" ] }, "evidence_basis": "provider_documented_pattern" }, { "id": "digitalocean-ns", "provider_id": "digitalocean", "service": "DNS", "role": "dns_hosting", "match_type": "exact", "patterns": [ "ns1.digitalocean.com", "ns2.digitalocean.com", "ns3.digitalocean.com" ], "status": "active", "source": { "url": "https://docs.digitalocean.com/products/networking/dns/getting-started/dns-registrars/", "title": "Point to DigitalOcean nameservers from common domain registrars", "basis": "DigitalOcean documents ns1, ns2 and ns3.digitalocean.com as its authoritative nameservers.", "reviewed_on": "2026-09-06", "review_due": "2027-03-06" }, "fixtures": { "positive": [ "ns1.digitalocean.com", "ns2.digitalocean.com", "ns3.digitalocean.com" ], "negative": [ "x.ns1.digitalocean.com", "ns1.digitalocean.com.example.org" ] }, "evidence_basis": "provider_documented_pattern" }, { "id": "dns-made-easy-ns", "provider_id": "dns-made-easy", "service": "Managed DNS", "role": "dns_hosting", "match_type": "hostname_suffix", "patterns": [ "dnsmadeeasy.com" ], "status": "active", "source": { "url": "https://support.dnsmadeeasy.com/hc/en-us/articles/34327239032603-DigiCert-DNS-Nameserver-Transition", "title": "DigiCert DNS Nameserver Transition", "basis": "DNS Made Easy documents its legacy dnsmadeeasy.com nameservers during the DigiCert DNS transition. A match identifies this service namespace, not a domain registrar.", "reviewed_on": "2026-09-06", "review_due": "2027-03-06" }, "fixtures": { "positive": [ "ns10.dnsmadeeasy.com" ], "negative": [ "dnsmadeeasy.com", "notdnsmadeeasy.com", "ns10.dnsmadeeasy.com.example.org" ] }, "evidence_basis": "provider_documented_pattern" }, { "id": "dnsimple-ns", "provider_id": "dnsimple", "service": "Authoritative DNS", "role": "dns_hosting", "match_type": "exact", "patterns": [ "ns1.dnsimple-edge.com", "ns2.dnsimple-edge.net", "ns3.dnsimple-edge.io", "ns4.dnsimple-edge.org", "ns1.dnsimple.com", "ns2.dnsimple.com", "ns3.dnsimple.com", "ns4.dnsimple.com" ], "status": "active", "source": { "url": "https://support.dnsimple.com/articles/dnsimple-nameservers/", "title": "DNSimple Name Servers", "basis": "DNSimple documents current edge nameservers and the four legacy dnsimple.com aliases, which remain resolvable after its 2026 migration.", "reviewed_on": "2026-09-06", "review_due": "2027-03-06" }, "fixtures": { "positive": [ "ns1.dnsimple-edge.com", "ns2.dnsimple-edge.net", "ns3.dnsimple-edge.io", "ns4.dnsimple-edge.org", "ns1.dnsimple.com", "ns2.dnsimple.com", "ns3.dnsimple.com", "ns4.dnsimple.com" ], "negative": [ "x.ns1.dnsimple-edge.com", "ns1.dnsimple-edge.com.example.org" ] }, "evidence_basis": "provider_documented_pattern" }, { "id": "exclaimer-spf", "provider_id": "exclaimer", "service": "Email signature service SPF", "role": "spf_reference", "match_type": "exact", "patterns": [ "spf.au.exclaimer.net", "spf.ca.exclaimer.net", "spf.eu.exclaimer.net", "spf.de.exclaimer.net", "spf.uae.exclaimer.net", "spf.uk.exclaimer.net", "spf.us.exclaimer.net" ], "status": "active", "source": { "url": "https://support.exclaimer.com/hc/en-gb/articles/4405827624337-Exclaimer-Simple-Mail-Transfer-Protocol-SMTP-host-list-and-Internet-Protocol-IP-Whitelist", "title": "Exclaimer SMTP host list and IP whitelist", "basis": "Exclaimer publishes seven regional SPF records, including Australia. The signature-processing association is distinct from mailbox hosting.", "reviewed_on": "2026-09-06", "review_due": "2027-03-06" }, "fixtures": { "positive": [ "spf.au.exclaimer.net", "spf.ca.exclaimer.net", "spf.eu.exclaimer.net", "spf.de.exclaimer.net", "spf.uae.exclaimer.net", "spf.uk.exclaimer.net", "spf.us.exclaimer.net" ], "negative": [ "x.spf.au.exclaimer.net", "spf.au.exclaimer.net.example.org" ] }, "evidence_basis": "provider_documented_pattern" }, { "id": "fastmail-mx", "provider_id": "fastmail", "service": "Mail routing", "role": "inbound_mail", "match_type": "exact", "patterns": [ "in1-smtp.messagingengine.com", "in2-smtp.messagingengine.com" ], "status": "active", "source": { "url": "https://www.fastmail.help/hc/en-us/articles/360060591153-Manual-DNS-configuration", "title": "Manual DNS configuration", "basis": "Fastmail publishes the two standard MX endpoints in messagingengine.com.", "reviewed_on": "2026-09-06", "review_due": "2027-03-06" }, "fixtures": { "positive": [ "in1-smtp.messagingengine.com", "in2-smtp.messagingengine.com" ], "negative": [ "x.in1-smtp.messagingengine.com", "in1-smtp.messagingengine.com.example.org" ] }, "evidence_basis": "provider_documented_pattern" }, { "id": "fastmail-spf", "provider_id": "fastmail", "service": "Mail SPF", "role": "spf_reference", "match_type": "exact", "patterns": [ "spf.messagingengine.com" ], "status": "active", "source": { "url": "https://www.fastmail.help/hc/en-us/articles/360060591153-Manual-DNS-configuration", "title": "Manual DNS configuration", "basis": "Fastmail documents the literal spf.messagingengine.com include for its sending infrastructure.", "reviewed_on": "2026-09-06", "review_due": "2027-03-06" }, "fixtures": { "positive": [ "spf.messagingengine.com" ], "negative": [ "x.spf.messagingengine.com", "spf.messagingengine.com.example.org" ] }, "evidence_basis": "provider_documented_pattern" }, { "id": "freshdesk-spf", "provider_id": "freshworks", "service": "Freshdesk SPF", "role": "spf_reference", "match_type": "exact", "patterns": [ "email.freshdesk.com" ], "status": "active", "source": { "url": "https://support.freshdesk.com/support/solutions/articles/43170-create-an-spf-record-to-ensure-proper-email-delivery", "title": "Create an SPF record to ensure proper support email delivery", "basis": "Freshdesk documents include:email.freshdesk.com. The provider ID names Freshworks and retains the Freshdesk service name.", "reviewed_on": "2026-09-06", "review_due": "2027-03-06" }, "fixtures": { "positive": [ "email.freshdesk.com" ], "negative": [ "x.email.freshdesk.com", "email.freshdesk.com.example.org" ] }, "evidence_basis": "provider_documented_pattern" }, { "id": "gandi-livedns-ns", "provider_id": "gandi", "service": "Authoritative DNS", "role": "dns_hosting", "match_type": "hostname_suffix", "patterns": [ "gandi.net" ], "status": "active", "source": { "url": "https://api.gandi.net/docs/livedns/", "title": "LiveDNS API", "basis": "Gandi’s LiveDNS API returns ns-number-a/b/c.gandi.net nameservers. Association is limited to the DNS role and the Gandi namespace; it does not establish registrar identity.", "reviewed_on": "2026-09-06", "review_due": "2027-03-06" }, "fixtures": { "positive": [ "ns-154-a.gandi.net", "ns-232-b.gandi.net", "ns-109-c.gandi.net" ], "negative": [ "gandi.net", "notgandi.net", "ns-154-a.gandi.net.example.org" ] }, "evidence_basis": "provider_documented_pattern" }, { "id": "godaddy-domaincontrol-ns", "provider_id": "godaddy", "service": "DomainControl DNS", "role": "dns_hosting", "match_type": "hostname_suffix", "patterns": [ "domaincontrol.com" ], "status": "active", "source": { "url": "https://webflow.com/integrations/godaddy-domain-control-center", "title": "Integrate GoDaddy DomainControl with Webflow", "basis": "Webflow’s GoDaddy integration documentation identifies domaincontrol.com nameservers as GoDaddy’s default DNS service. A DNS association does not identify the registrar.", "reviewed_on": "2026-09-06", "review_due": "2027-03-06" }, "fixtures": { "positive": [ "ns01.domaincontrol.com" ], "negative": [ "domaincontrol.com", "notdomaincontrol.com", "ns01.domaincontrol.com.example.org" ] }, "evidence_basis": "provider_documented_pattern" }, { "id": "godaddy-spf", "provider_id": "godaddy", "service": "Hosted email SPF", "role": "spf_reference", "match_type": "exact", "patterns": [ "secureserver.net" ], "status": "active", "source": { "url": "https://www.godaddy.com/help/configuring-dns-for-your-web-hosting-cpanel-domain-8852", "title": "Configuring DNS for your Web Hosting (cPanel) domain", "basis": "GoDaddy documents include:secureserver.net for its hosted email infrastructure.", "reviewed_on": "2026-09-06", "review_due": "2027-03-06" }, "fixtures": { "positive": [ "secureserver.net" ], "negative": [ "x.secureserver.net", "secureserver.net.example.org" ] }, "evidence_basis": "provider_documented_pattern" }, { "id": "google-cloud-dns-ns", "provider_id": "google", "service": "Cloud DNS", "role": "dns_hosting", "match_type": "exact", "patterns": [ "ns-cloud-a1.googledomains.com", "ns-cloud-a2.googledomains.com", "ns-cloud-a3.googledomains.com", "ns-cloud-a4.googledomains.com", "ns-cloud-b1.googledomains.com", "ns-cloud-b2.googledomains.com", "ns-cloud-b3.googledomains.com", "ns-cloud-b4.googledomains.com", "ns-cloud-c1.googledomains.com", "ns-cloud-c2.googledomains.com", "ns-cloud-c3.googledomains.com", "ns-cloud-c4.googledomains.com", "ns-cloud-d1.googledomains.com", "ns-cloud-d2.googledomains.com", "ns-cloud-d3.googledomains.com", "ns-cloud-d4.googledomains.com", "ns-cloud-e1.googledomains.com", "ns-cloud-e2.googledomains.com", "ns-cloud-e3.googledomains.com", "ns-cloud-e4.googledomains.com" ], "status": "active", "source": { "url": "https://docs.cloud.google.com/dns/docs/migrating", "title": "Migrate to Cloud DNS", "basis": "Google documents five Cloud DNS nameserver shards, a through e, with four servers per shard. Legacy Google Domains, googlehosted and CDN names are not used as DNS-provider markers.", "reviewed_on": "2026-09-06", "review_due": "2027-03-06" }, "fixtures": { "positive": [ "ns-cloud-a1.googledomains.com", "ns-cloud-a2.googledomains.com", "ns-cloud-a3.googledomains.com", "ns-cloud-a4.googledomains.com", "ns-cloud-b1.googledomains.com", "ns-cloud-b2.googledomains.com", "ns-cloud-b3.googledomains.com", "ns-cloud-b4.googledomains.com", "ns-cloud-c1.googledomains.com", "ns-cloud-c2.googledomains.com", "ns-cloud-c3.googledomains.com", "ns-cloud-c4.googledomains.com", "ns-cloud-d1.googledomains.com", "ns-cloud-d2.googledomains.com", "ns-cloud-d3.googledomains.com", "ns-cloud-d4.googledomains.com", "ns-cloud-e1.googledomains.com", "ns-cloud-e2.googledomains.com", "ns-cloud-e3.googledomains.com", "ns-cloud-e4.googledomains.com" ], "negative": [ "x.ns-cloud-a1.googledomains.com", "ns-cloud-a1.googledomains.com.example.org" ] }, "evidence_basis": "provider_documented_pattern" }, { "id": "google-workspace-mx", "provider_id": "google", "service": "Google Workspace mail routing", "role": "inbound_mail", "match_type": "exact", "patterns": [ "smtp.google.com", "aspmx.l.google.com", "alt1.aspmx.l.google.com", "alt2.aspmx.l.google.com", "alt3.aspmx.l.google.com", "alt4.aspmx.l.google.com", "aspmx2.googlemail.com", "aspmx3.googlemail.com" ], "status": "active", "source": { "url": "https://knowledge.workspace.google.com/admin/domains/set-up-mx-records-for-google-workspace", "title": "Set up MX records for Google Workspace", "basis": "Google documents smtp.google.com and continuing support for legacy aspmx MX records. The allowlist includes the historical googlemail.com pair observed in .auDO; unrelated googlemail hosts are not matched.", "reviewed_on": "2026-09-06", "review_due": "2027-03-06" }, "fixtures": { "positive": [ "SMTP.GOOGLE.COM.", "aspmx.l.google.com", "alt1.aspmx.l.google.com", "alt2.aspmx.l.google.com", "alt3.aspmx.l.google.com", "alt4.aspmx.l.google.com", "aspmx2.googlemail.com", "aspmx3.googlemail.com" ], "negative": [ "mail.google.com", "evil.smtp.google.com", "smtp.google.com.example.org", "alt5.aspmx.l.google.com" ] }, "evidence_basis": "provider_documented_pattern" }, { "id": "google-workspace-spf", "provider_id": "google", "service": "Google Workspace SPF", "role": "spf_reference", "match_type": "exact", "patterns": [ "_spf.google.com" ], "status": "active", "source": { "url": "https://knowledge.workspace.google.com/admin/security/set-up-spf", "title": "Set up SPF", "basis": "Google documents include:_spf.google.com for Google Workspace sending infrastructure.", "reviewed_on": "2026-09-06", "review_due": "2027-03-06" }, "fixtures": { "positive": [ "_SPF.GOOGLE.COM." ], "negative": [ "google.com", "_spf.google.com.example.org" ] }, "evidence_basis": "provider_documented_pattern" }, { "id": "hetzner-ns", "provider_id": "hetzner", "service": "Primary, secondary and hosting DNS", "role": "dns_hosting", "match_type": "exact", "patterns": [ "hydrogen.ns.hetzner.com", "oxygen.ns.hetzner.com", "helium.ns.hetzner.de", "ns1.first-ns.de", "robotns2.second-ns.de", "robotns3.second-ns.com", "ns1.your-server.de", "ns.second-ns.com", "ns3.second-ns.de" ], "status": "active", "source": { "url": "https://docs.hetzner.com/networking/dns/overview/", "title": "DNS overview: authoritative name servers", "basis": "Hetzner publishes separate primary, secondary and konsoleH nameserver sets. The exact allowlist covers all three without matching arbitrary second-ns domains.", "reviewed_on": "2026-09-06", "review_due": "2027-03-06" }, "fixtures": { "positive": [ "hydrogen.ns.hetzner.com", "oxygen.ns.hetzner.com", "helium.ns.hetzner.de", "ns1.first-ns.de", "robotns2.second-ns.de", "robotns3.second-ns.com", "ns1.your-server.de", "ns.second-ns.com", "ns3.second-ns.de" ], "negative": [ "x.hydrogen.ns.hetzner.com", "hydrogen.ns.hetzner.com.example.org" ] }, "evidence_basis": "provider_documented_pattern" }, { "id": "hostinger-dns-parking-ns", "provider_id": "hostinger", "service": "Managed DNS", "role": "dns_hosting", "match_type": "hostname_suffix", "patterns": [ "dns-parking.com" ], "status": "active", "source": { "url": "https://www.hostinger.com/support/8671230-how-to-look-up-domain-nameservers-at-hostinger/", "title": "How to look up domain nameservers at Hostinger", "basis": "Hostinger documents the dns-parking.com family, including numbered and named hosts, as its DNS-zone management namespace.", "reviewed_on": "2026-09-06", "review_due": "2027-03-06" }, "fixtures": { "positive": [ "ns1.dns-parking.com", "pixel.dns-parking.com" ], "negative": [ "dns-parking.com", "notdns-parking.com", "ns1.dns-parking.com.example.org" ] }, "evidence_basis": "provider_documented_pattern" }, { "id": "ionos-ns", "provider_id": "ionos", "service": "Authoritative DNS", "role": "dns_hosting", "match_type": "hostname_suffix", "patterns": [ "ui-dns.de", "ui-dns.biz", "ui-dns.org", "ui-dns.com" ], "status": "active", "source": { "url": "https://www.ionos.com/help/domains/general-information-about-dns-settings/default-dns-settings-for-11-ionos-domains/", "title": "Default DNS Settings for IONOS Domains", "basis": "IONOS documents its four ui-dns namespace families for domain DNS.", "reviewed_on": "2026-09-06", "review_due": "2027-03-06" }, "fixtures": { "positive": [ "ns1045.ui-dns.de", "ns1045.ui-dns.biz", "ns1045.ui-dns.org", "ns1045.ui-dns.com" ], "negative": [ "ui-dns.de", "notui-dns.de", "ns1045.ui-dns.de.example.org" ] }, "evidence_basis": "provider_documented_pattern" }, { "id": "mailchimp-marketing-spf", "provider_id": "mailchimp", "service": "Marketing email SPF reference", "role": "spf_reference", "match_type": "exact", "patterns": [ "servers.mcsv.net" ], "status": "active", "source": { "url": "https://knowledge.workspace.google.com/admin/security/set-up-spf", "title": "Set up SPF: Google Workspace and other senders", "basis": "Google’s supported sender configuration table identifies servers.mcsv.net as the Mailchimp SPF reference. Presence of the reference does not establish Return-Path alignment or active sending.", "reviewed_on": "2026-09-06", "review_due": "2027-03-06" }, "fixtures": { "positive": [ "servers.mcsv.net" ], "negative": [ "x.servers.mcsv.net", "servers.mcsv.net.example.org" ] }, "evidence_basis": "provider_documented_pattern" }, { "id": "mailgun-mx", "provider_id": "mailgun", "service": "Receiving and routing", "role": "inbound_mail", "match_type": "exact", "patterns": [ "mxa.mailgun.org", "mxb.mailgun.org" ], "status": "active", "source": { "url": "https://documentation.mailgun.com/docs/mailgun/user-manual/domains/domains-verify", "title": "Domain Verification", "basis": "Mailgun documents MX records for receiving, routing and storing messages; this is not a mailbox-provider claim.", "reviewed_on": "2026-09-06", "review_due": "2027-03-06" }, "fixtures": { "positive": [ "mxa.mailgun.org", "mxb.mailgun.org" ], "negative": [ "x.mxa.mailgun.org", "mxa.mailgun.org.example.org" ] }, "evidence_basis": "provider_documented_pattern" }, { "id": "mailgun-spf", "provider_id": "mailgun", "service": "Sending SPF", "role": "spf_reference", "match_type": "exact", "patterns": [ "mailgun.org" ], "status": "active", "source": { "url": "https://documentation.mailgun.com/docs/mailgun/user-manual/domains/domains-verify", "title": "Domain Verification", "basis": "Mailgun documents include:mailgun.org for sending-domain verification.", "reviewed_on": "2026-09-06", "review_due": "2027-03-06" }, "fixtures": { "positive": [ "mailgun.org" ], "negative": [ "x.mailgun.org", "mailgun.org.example.org" ] }, "evidence_basis": "provider_documented_pattern" }, { "id": "microsoft-azure-dns-ns", "provider_id": "microsoft", "service": "Azure DNS", "role": "dns_hosting", "match_type": "hostname_suffix", "patterns": [ "azure-dns.com", "azure-dns.net", "azure-dns.org", "azure-dns.info" ], "status": "active", "source": { "url": "https://learn.microsoft.com/en-us/azure/dns/dns-delegate-domain-azure-dns", "title": "Delegate a domain to Azure DNS", "basis": "Microsoft documents the four azure-dns nameserver namespaces for delegated Azure DNS zones.", "reviewed_on": "2026-09-06", "review_due": "2027-03-06" }, "fixtures": { "positive": [ "ns1-37.azure-dns.com", "ns2-37.azure-dns.net", "ns3-37.azure-dns.org", "ns4-37.azure-dns.info" ], "negative": [ "azure-dns.com", "notazure-dns.com", "ns1-37.azure-dns.com.example.org" ] }, "evidence_basis": "provider_documented_pattern" }, { "id": "microsoft-exchange-online-mx", "provider_id": "microsoft", "service": "Exchange Online mail routing", "role": "inbound_mail", "match_type": "hostname_suffix", "patterns": [ "mail.protection.outlook.com" ], "status": "active", "source": { "url": "https://learn.microsoft.com/en-us/microsoft-365/admin/dns/create-dns-records-at-cloudflare?view=o365-worldwide", "title": "Connect DNS records to Microsoft 365", "basis": "Microsoft documents a domain-specific MX endpoint below mail.protection.outlook.com; the record does not identify a mailbox backend or contract.", "reviewed_on": "2026-09-06", "review_due": "2027-03-06" }, "fixtures": { "positive": [ "example-com.mail.protection.outlook.com." ], "negative": [ "mail.protection.outlook.com", "notmail.protection.outlook.com", "example-com.mail.protection.outlook.com.example.org" ] }, "evidence_basis": "provider_documented_pattern" }, { "id": "microsoft-exchange-online-spf", "provider_id": "microsoft", "service": "Exchange Online SPF", "role": "spf_reference", "match_type": "exact", "patterns": [ "spf.protection.outlook.com" ], "status": "active", "source": { "url": "https://learn.microsoft.com/en-us/microsoft-365/admin/dns/create-dns-records-at-cloudflare?view=o365-worldwide", "title": "Connect DNS records to Microsoft 365", "basis": "Microsoft documents include:spf.protection.outlook.com in its SPF setup instructions.", "reviewed_on": "2026-09-06", "review_due": "2027-03-06" }, "fixtures": { "positive": [ "spf.protection.outlook.com" ], "negative": [ "x.spf.protection.outlook.com", "spf.protection.outlook.com.example.org" ] }, "evidence_basis": "provider_documented_pattern" }, { "id": "mimecast-gateway-mx", "provider_id": "mimecast", "service": "Email Security Cloud Gateway", "role": "inbound_mail", "match_type": "exact", "patterns": [ "eu-smtp-inbound-1.mimecast.com", "eu-smtp-inbound-2.mimecast.com", "de-smtp-inbound-1.mimecast.com", "de-smtp-inbound-2.mimecast.com", "us-smtp-inbound-1.mimecast.com", "us-smtp-inbound-2.mimecast.com", "usb-smtp-inbound-1.mimecast.com", "usb-smtp-inbound-2.mimecast.com", "ca-smtp-inbound-1.mimecast.com", "ca-smtp-inbound-2.mimecast.com", "au-smtp-inbound-1.mimecast.com", "au-smtp-inbound-2.mimecast.com", "za-smtp-inbound-1.mimecast.co.za", "za-smtp-inbound-2.mimecast.co.za", "je-smtp-inbound-1.mimecast-offshore.com", "je-smtp-inbound-2.mimecast-offshore.com" ], "status": "active", "source": { "url": "https://mimecastsupport.zendesk.com/hc/en-us/articles/34000417366675-Account-Settings-Mimecast-Gateway-Configuration", "title": "Account Settings - Mimecast Gateway Configuration", "basis": "Mimecast publishes the regional inbound MX pairs, including Australia, South Africa and offshore. Outbound and journaling hosts are not treated as inbound service signatures.", "reviewed_on": "2026-09-06", "review_due": "2027-03-06" }, "fixtures": { "positive": [ "eu-smtp-inbound-1.mimecast.com", "eu-smtp-inbound-2.mimecast.com", "de-smtp-inbound-1.mimecast.com", "de-smtp-inbound-2.mimecast.com", "us-smtp-inbound-1.mimecast.com", "us-smtp-inbound-2.mimecast.com", "usb-smtp-inbound-1.mimecast.com", "usb-smtp-inbound-2.mimecast.com", "ca-smtp-inbound-1.mimecast.com", "ca-smtp-inbound-2.mimecast.com", "au-smtp-inbound-1.mimecast.com", "au-smtp-inbound-2.mimecast.com", "za-smtp-inbound-1.mimecast.co.za", "za-smtp-inbound-2.mimecast.co.za", "je-smtp-inbound-1.mimecast-offshore.com", "je-smtp-inbound-2.mimecast-offshore.com" ], "negative": [ "x.eu-smtp-inbound-1.mimecast.com", "eu-smtp-inbound-1.mimecast.com.example.org" ] }, "evidence_basis": "provider_documented_pattern" }, { "id": "mimecast-spf", "provider_id": "mimecast", "service": "Gateway SPF", "role": "spf_reference", "match_type": "exact", "patterns": [ "_netblocks.mimecast.com", "au._netblocks.mimecast.com", "eu._netblocks.mimecast.com", "us._netblocks.mimecast.com", "de._netblocks.mimecast.com", "ca._netblocks.mimecast.com" ], "status": "active", "source": { "url": "https://mimecastsupport.zendesk.com/hc/en-us/articles/34000672838803-Policies-Sender-Policy-Framework", "title": "Policies - Sender Policy Framework", "basis": "Mimecast documents the global and regional XX._netblocks.mimecast.com SPF references. Matching a literal reference does not evaluate the policy or establish active mail flow.", "reviewed_on": "2026-09-06", "review_due": "2027-03-06" }, "fixtures": { "positive": [ "_netblocks.mimecast.com", "au._netblocks.mimecast.com", "eu._netblocks.mimecast.com", "us._netblocks.mimecast.com", "de._netblocks.mimecast.com", "ca._netblocks.mimecast.com" ], "negative": [ "x._netblocks.mimecast.com", "_netblocks.mimecast.com.example.org" ] }, "evidence_basis": "provider_documented_pattern" }, { "id": "namecheap-ns", "provider_id": "namecheap", "service": "BasicDNS and hosting DNS", "role": "dns_hosting", "match_type": "exact", "patterns": [ "dns1.registrar-servers.com", "dns2.registrar-servers.com", "dns1.namecheaphosting.com", "dns2.namecheaphosting.com" ], "status": "active", "source": { "url": "https://www.namecheap.com/support/knowledgebase/article.aspx/9434/10/using-default-nameservers-vs-hosting-nameservers/", "title": "Using default nameservers vs hosting nameservers", "basis": "Namecheap distinguishes its default DNS pair from the hosting DNS pair; both are documented infrastructure associations.", "reviewed_on": "2026-09-06", "review_due": "2027-03-06" }, "fixtures": { "positive": [ "dns1.registrar-servers.com", "dns2.registrar-servers.com", "dns1.namecheaphosting.com", "dns2.namecheaphosting.com" ], "negative": [ "x.dns1.registrar-servers.com", "dns1.registrar-servers.com.example.org" ] }, "evidence_basis": "provider_documented_pattern" }, { "id": "postmark-spf", "provider_id": "postmark", "service": "Sending SPF reference", "role": "spf_reference", "match_type": "exact", "patterns": [ "spf.mtasv.net" ], "status": "active", "source": { "url": "https://postmarkapp.com/support/article/how-do-i-set-up-spf-for-postmark", "title": "How do I set up SPF for Postmark?", "basis": "Postmark identifies spf.mtasv.net while explaining that a root-domain include does not itself provide Return-Path alignment. This rule labels the reference only.", "reviewed_on": "2026-09-06", "review_due": "2027-03-06" }, "fixtures": { "positive": [ "spf.mtasv.net" ], "negative": [ "x.spf.mtasv.net", "spf.mtasv.net.example.org" ] }, "evidence_basis": "provider_documented_pattern" }, { "id": "proofpoint-essentials-mx", "provider_id": "proofpoint", "service": "Essentials email gateway", "role": "inbound_mail", "match_type": "hostname_suffix", "patterns": [ "ppe-hosted.com" ], "status": "active", "source": { "url": "https://www.proofpoint.com/sites/default/files/getting_started_guide_us2-011117-cm.pdf", "title": "Proofpoint Essentials Getting Started Guide (US2)", "basis": "Proofpoint’s published guide identifies the ppe-hosted.com MX namespace for Essentials, including mx1-us2 and mx2-us2. The namespace is also present in the pinned .auDO sample; it does not identify the reseller.", "reviewed_on": "2026-09-06", "review_due": "2027-03-06" }, "fixtures": { "positive": [ "mx1-us2.ppe-hosted.com", "mx2-us2.ppe-hosted.com", "mx1-us1.ppe-hosted.com" ], "negative": [ "ppe-hosted.com", "notppe-hosted.com", "mx1-us2.ppe-hosted.com.example.org" ] }, "evidence_basis": "provider_documented_pattern" }, { "id": "proofpoint-hosted-gslb-mx", "provider_id": "proofpoint", "service": "Hosted email gateway", "role": "inbound_mail", "match_type": "hostname_suffix", "patterns": [ "pphosted.com" ], "status": "active", "source": { "url": "https://support.atlassian.com/jira/kb/JSM-customers-dont-receive-password-reset-emails-when-using-Proofpoint-email-filtering/", "title": "JSM customers do not receive password reset emails when using Proofpoint email filtering", "basis": "Atlassian’s integration troubleshooting identifies pphosted.com MX hosts as Proofpoint gateways. The label covers both dedicated mx0a/mx0b and GSLB routing endpoints, without identifying the mailbox backend.", "reviewed_on": "2026-09-06", "review_due": "2027-03-06" }, "fixtures": { "positive": [ "mx0a-003c4301.pphosted.com", "mx0b-003c4301.pphosted.com", "mxa-0036d701.gslb.pphosted.com" ], "negative": [ "pphosted.com", "notpphosted.com", "mx0a-003c4301.pphosted.com.example.org" ] }, "evidence_basis": "provider_documented_pattern" }, { "id": "proton-mail-mx", "provider_id": "proton", "service": "Proton Mail routing", "role": "inbound_mail", "match_type": "exact", "patterns": [ "mail.protonmail.ch", "mailsec.protonmail.ch" ], "status": "active", "source": { "url": "https://proton.me/support/custom-domain-hostpoint", "title": "How to use a custom domain from Hostpoint with Proton Mail", "basis": "Proton’s custom-domain guide publishes its primary and secondary MX records.", "reviewed_on": "2026-09-06", "review_due": "2027-03-06" }, "fixtures": { "positive": [ "mail.protonmail.ch", "mailsec.protonmail.ch" ], "negative": [ "x.mail.protonmail.ch", "mail.protonmail.ch.example.org" ] }, "evidence_basis": "provider_documented_pattern" }, { "id": "rackspace-email-mx", "provider_id": "rackspace", "service": "Cloud Office mail routing", "role": "inbound_mail", "match_type": "exact", "patterns": [ "mx1.emailsrvr.com", "mx2.emailsrvr.com" ], "status": "active", "source": { "url": "https://docs.rackspace.com/docs/set-up-dns-records-for-cloud-office-email", "title": "Set up DNS records for Cloud Office email", "basis": "Rackspace publishes these two Cloud Office mail exchangers.", "reviewed_on": "2026-09-06", "review_due": "2027-03-06" }, "fixtures": { "positive": [ "mx1.emailsrvr.com", "mx2.emailsrvr.com" ], "negative": [ "x.mx1.emailsrvr.com", "mx1.emailsrvr.com.example.org" ] }, "evidence_basis": "provider_documented_pattern" }, { "id": "rackspace-email-spf", "provider_id": "rackspace", "service": "Cloud Office SPF", "role": "spf_reference", "match_type": "exact", "patterns": [ "emailsrvr.com" ], "status": "active", "source": { "url": "https://docs.rackspace.com/docs/set-up-dns-records-for-cloud-office-email", "title": "Set up DNS records for Cloud Office email", "basis": "Rackspace documents include:emailsrvr.com for Cloud Office email.", "reviewed_on": "2026-09-06", "review_due": "2027-03-06" }, "fixtures": { "positive": [ "emailsrvr.com" ], "negative": [ "x.emailsrvr.com", "emailsrvr.com.example.org" ] }, "evidence_basis": "provider_documented_pattern" }, { "id": "salesforce-spf", "provider_id": "salesforce", "service": "Salesforce application SPF", "role": "spf_reference", "match_type": "exact", "patterns": [ "_spf.salesforce.com" ], "status": "active", "source": { "url": "https://help.salesforce.com/s/articleView?id=000382664&language=en_US&type=1", "title": "Sender Policy Framework and Salesforce SPF Records", "basis": "Salesforce specifies _spf.salesforce.com for application mail and cautions against treating other salesforce.com SPF records as equivalent.", "reviewed_on": "2026-09-06", "review_due": "2027-03-06" }, "fixtures": { "positive": [ "_spf.salesforce.com" ], "negative": [ "x._spf.salesforce.com", "_spf.salesforce.com.example.org" ] }, "evidence_basis": "provider_documented_pattern" }, { "id": "securence-mx", "provider_id": "securence", "service": "Email filtering gateway", "role": "inbound_mail", "match_type": "hostname_suffix", "patterns": [ "securence.com" ], "status": "active", "source": { "url": "https://securence.com/pages/FAQ", "title": "Securence Frequently Asked Questions", "basis": "Securence’s own FAQ publishes smtp1-msp.securence.com for gateway MX routing. Only an observed MX under the service namespace is associated.", "reviewed_on": "2026-09-06", "review_due": "2027-03-06" }, "fixtures": { "positive": [ "smtp1-msp.securence.com", "smtp1.mke.securence.com" ], "negative": [ "securence.com", "notsecurence.com", "smtp1-msp.securence.com.example.org" ] }, "evidence_basis": "provider_documented_pattern" }, { "id": "shopify-spf", "provider_id": "shopify", "service": "Shop email SPF reference", "role": "spf_reference", "match_type": "exact", "patterns": [ "shops.shopify.com" ], "status": "active", "source": { "url": "https://knowledge.workspace.google.com/admin/security/set-up-spf", "title": "Set up SPF: Google Workspace and other senders", "basis": "Google’s supported sender configuration table identifies shops.shopify.com as the Shopify SPF reference.", "reviewed_on": "2026-09-06", "review_due": "2027-03-06" }, "fixtures": { "positive": [ "shops.shopify.com" ], "negative": [ "x.shops.shopify.com", "shops.shopify.com.example.org" ] }, "evidence_basis": "provider_documented_pattern" }, { "id": "sophos-central-mx", "provider_id": "sophos", "service": "Central Email Gateway", "role": "inbound_mail", "match_type": "hostname_suffix", "patterns": [ "prod.hydra.sophos.com" ], "status": "active", "source": { "url": "https://docs.sophos.com/central/customer/help/en-us/ManageYourProducts/EmailSecurity/EmailDomainInfo/", "title": "Email domain information", "basis": "Sophos publishes region-specific mx-01 and mx-02 records in prod.hydra.sophos.com for Central Email Gateway.", "reviewed_on": "2026-09-06", "review_due": "2027-03-06" }, "fixtures": { "positive": [ "mx-01-us-west-2.prod.hydra.sophos.com" ], "negative": [ "prod.hydra.sophos.com", "notprod.hydra.sophos.com", "mx-01-us-west-2.prod.hydra.sophos.com.example.org" ] }, "evidence_basis": "provider_documented_pattern" }, { "id": "symantec-email-security-mx", "provider_id": "broadcom", "service": "Symantec Email Security.cloud", "role": "inbound_mail", "match_type": "hostname_suffix", "patterns": [ "messagelabs.com" ], "status": "active", "source": { "url": "https://knowledge.broadcom.com/external/article/161419/mail-exchanger-mx-record-setup-with-emai.html", "title": "Mail exchanger (MX) record setup with Email Security.cloud", "basis": "Broadcom documents regional cluster MX endpoints below messagelabs.com for Symantec Email Security.cloud.", "reviewed_on": "2026-09-06", "review_due": "2027-03-06" }, "fixtures": { "positive": [ "cluster1.eu.messagelabs.com" ], "negative": [ "messagelabs.com", "notmessagelabs.com", "cluster1.eu.messagelabs.com.example.org" ] }, "evidence_basis": "provider_documented_pattern" }, { "id": "titan-email-eu-mx", "provider_id": "titan", "service": "Mail routing (Europe)", "role": "inbound_mail", "match_type": "exact", "patterns": [ "mx0101.titan.email", "mx0102.titan.email" ], "status": "active", "source": { "url": "https://support.titan.email/hc/en-us/articles/4406866483737-Setup-Titan-MX-and-TXT-records-for-Blacknight", "title": "Setup Titan MX and TXT records for Blacknight", "basis": "Titan’s main domain setup links European customers to this guide, which publishes mx0101 and mx0102.titan.email.", "reviewed_on": "2026-09-06", "review_due": "2027-03-06" }, "fixtures": { "positive": [ "mx0101.titan.email", "mx0102.titan.email" ], "negative": [ "x.mx0101.titan.email", "mx0101.titan.email.example.org" ] }, "evidence_basis": "provider_documented_pattern" }, { "id": "titan-email-mx", "provider_id": "titan", "service": "Mail routing", "role": "inbound_mail", "match_type": "exact", "patterns": [ "mx1.titan.email", "mx2.titan.email" ], "status": "active", "source": { "url": "https://support.titan.email/hc/en-us/articles/360036853934-Setup-Titan-for-your-domain", "title": "Setup Titan for your domain", "basis": "Titan documents its two MX records, including when the service is sold through a hosting partner.", "reviewed_on": "2026-09-06", "review_due": "2027-03-06" }, "fixtures": { "positive": [ "mx1.titan.email", "mx2.titan.email" ], "negative": [ "x.mx1.titan.email", "mx1.titan.email.example.org" ] }, "evidence_basis": "provider_documented_pattern" }, { "id": "titan-email-spf", "provider_id": "titan", "service": "Mail SPF", "role": "spf_reference", "match_type": "exact", "patterns": [ "spf.titan.email" ], "status": "active", "source": { "url": "https://support.titan.email/hc/en-us/articles/360036853934-Setup-Titan-for-your-domain", "title": "Setup Titan for your domain", "basis": "Titan documents include:spf.titan.email alongside its standard MX records.", "reviewed_on": "2026-09-06", "review_due": "2027-03-06" }, "fixtures": { "positive": [ "spf.titan.email" ], "negative": [ "x.spf.titan.email", "spf.titan.email.example.org" ] }, "evidence_basis": "provider_documented_pattern" }, { "id": "tpp-wholesale-ns", "provider_id": "tpp-wholesale", "service": "Managed DNS", "role": "dns_hosting", "match_type": "exact", "patterns": [ "ns1.partnerconsole.net", "ns2.partnerconsole.net", "ns3.partnerconsole.net", "ns1.name-server.io", "ns2.name-server.io", "ns-1.ezyreg.com", "ns-2.ezyreg.com" ], "status": "active", "source": { "url": "https://support.tppwholesale.com.au/hc/en-gb/articles/360009201278-Modifying-Your-Domain-s-Nameservers", "title": "Modifying Your Domain’s Nameservers", "basis": "TPP documents PartnerConsole, current cPanel and legacy ezyreg nameservers. These infrastructure endpoints do not establish which retail brand supplies the service.", "reviewed_on": "2026-09-06", "review_due": "2027-03-06" }, "fixtures": { "positive": [ "ns1.partnerconsole.net", "ns2.partnerconsole.net", "ns3.partnerconsole.net", "ns1.name-server.io", "ns2.name-server.io", "ns-1.ezyreg.com", "ns-2.ezyreg.com" ], "negative": [ "x.ns1.partnerconsole.net", "ns1.partnerconsole.net.example.org" ] }, "evidence_basis": "provider_documented_pattern" }, { "id": "twilio-sendgrid-spf", "provider_id": "twilio-sendgrid", "service": "SendGrid SPF", "role": "spf_reference", "match_type": "exact", "patterns": [ "sendgrid.net" ], "status": "active", "source": { "url": "https://www.twilio.com/docs/sendgrid/ui/sending-email/verify-sender-with-spf", "title": "Verify sending email servers with SPF", "basis": "Twilio’s SendGrid documentation specifies include:sendgrid.net.", "reviewed_on": "2026-09-06", "review_due": "2027-03-06" }, "fixtures": { "positive": [ "sendgrid.net" ], "negative": [ "x.sendgrid.net", "sendgrid.net.example.org" ] }, "evidence_basis": "provider_documented_pattern" }, { "id": "ultradns-net-ns", "provider_id": "ultradns", "service": "Managed DNS", "role": "dns_hosting", "match_type": "hostname_suffix", "patterns": [ "ultradns.net" ], "status": "active", "source": { "url": "https://docs.ultradns.com/Content/MSP_User_Guide/Content/User%20Guides/MSP_User_Guide/Records/NS%20Records.htm", "title": "NS Records", "basis": "UltraDNS documents the ultradns.net authoritative nameserver namespace. Other UltraDNS TLD families and branded CSC endpoints require separately documented signatures.", "reviewed_on": "2026-09-06", "review_due": "2027-03-06" }, "fixtures": { "positive": [ "udns1.ultradns.net", "pdns111.ultradns.net" ], "negative": [ "ultradns.net", "notultradns.net", "udns1.ultradns.net.example.org" ] }, "evidence_basis": "provider_documented_pattern" }, { "id": "ventraip-hostingplatform-ns", "provider_id": "ventraip", "service": "HostingPlatform DNS", "role": "dns_hosting", "match_type": "hostname_suffix", "patterns": [ "hostingplatform.net.au" ], "status": "active", "source": { "url": "https://ventraip.com.au/support-centre/nameservers-for-ventraip-reseller-hosting-services/", "title": "Nameservers for VentraIP reseller hosting services", "basis": "VentraIP publishes hostingplatform.net.au nameservers for its hosting platform; the association does not identify a reseller or customer contract.", "reviewed_on": "2026-09-06", "review_due": "2027-03-06" }, "fixtures": { "positive": [ "ns1.syd2.hostingplatform.net.au" ], "negative": [ "hostingplatform.net.au", "nothostingplatform.net.au", "ns1.syd2.hostingplatform.net.au.example.org" ] }, "evidence_basis": "provider_documented_pattern" }, { "id": "wix-dns-ns", "provider_id": "wix", "service": "Managed DNS", "role": "dns_hosting", "match_type": "hostname_suffix", "patterns": [ "wixdns.net" ], "status": "active", "source": { "url": "https://help.afrihost.com/entry/how-to-connect-your-domain-to-your-wix-site/", "title": "How to connect your domain to a Wix site", "basis": "Afrihost’s Wix integration guide publishes ns8.wixdns.net and ns9.wixdns.net as Wix name server examples. This labels the observed DNS namespace, not the target website software.", "reviewed_on": "2026-09-06", "review_due": "2027-03-06" }, "fixtures": { "positive": [ "ns8.wixdns.net", "ns9.wixdns.net" ], "negative": [ "wixdns.net", "notwixdns.net", "ns8.wixdns.net.example.org" ] }, "evidence_basis": "provider_documented_pattern" }, { "id": "wordpress-com-ns", "provider_id": "wordpress-com", "service": "Managed DNS", "role": "dns_hosting", "match_type": "exact", "patterns": [ "ns1.wordpress.com", "ns2.wordpress.com", "ns3.wordpress.com" ], "status": "active", "source": { "url": "https://wordpress.com/support/domains/change-name-servers/", "title": "Change a domain’s name servers", "basis": "WordPress.com documents its three name servers for domains registered at other companies. The association does not imply the target website runs WordPress.", "reviewed_on": "2026-09-06", "review_due": "2027-03-06" }, "fixtures": { "positive": [ "ns1.wordpress.com", "ns2.wordpress.com", "ns3.wordpress.com" ], "negative": [ "x.ns1.wordpress.com", "ns1.wordpress.com.example.org" ] }, "evidence_basis": "provider_documented_pattern" }, { "id": "zendesk-spf", "provider_id": "zendesk", "service": "Support email SPF", "role": "spf_reference", "match_type": "exact", "patterns": [ "mail.zendesk.com" ], "status": "active", "source": { "url": "https://support.zendesk.com/hc/en-us/articles/4408832543770-Allowing-Zendesk-to-send-email-on-behalf-of-your-email-domain", "title": "Allowing Zendesk to send email on behalf of your email domain", "basis": "Zendesk documents include:mail.zendesk.com for support email.", "reviewed_on": "2026-09-06", "review_due": "2027-03-06" }, "fixtures": { "positive": [ "mail.zendesk.com" ], "negative": [ "x.mail.zendesk.com", "mail.zendesk.com.example.org" ] }, "evidence_basis": "provider_documented_pattern" }, { "id": "zoho-mail-au-mx", "provider_id": "zoho", "service": "Zoho Mail routing (Australia)", "role": "inbound_mail", "match_type": "exact", "patterns": [ "mx.zoho.com.au", "mx2.zoho.com.au", "mx3.zoho.com.au" ], "status": "active", "source": { "url": "https://help.zoho.com/portal/en/community/topic/unable-to-send-email-in-zoho-mail", "title": "Unable to send email in Zoho Mail: Zoho Support response", "basis": "A Zoho Mail Support response explicitly supplies the three Australian MX values as replacements for the US data-centre records.", "reviewed_on": "2026-09-06", "review_due": "2027-03-06" }, "fixtures": { "positive": [ "mx.zoho.com.au", "mx2.zoho.com.au", "mx3.zoho.com.au" ], "negative": [ "x.mx.zoho.com.au", "mx.zoho.com.au.example.org" ] }, "evidence_basis": "provider_documented_pattern" }, { "id": "zoho-mail-mx", "provider_id": "zoho", "service": "Zoho Mail routing", "role": "inbound_mail", "match_type": "exact", "patterns": [ "mx.zoho.com", "mx2.zoho.com", "mx3.zoho.com" ], "status": "active", "source": { "url": "https://www.zoho.com/mail/help/adminconsole/godaddy.html", "title": "GoDaddy DNS Mapping - CNAME, MX, SPF, and DKIM", "basis": "Zoho’s setup guide lists these three US data-centre MX endpoints; regional endpoints are added separately when documented.", "reviewed_on": "2026-09-06", "review_due": "2027-03-06" }, "fixtures": { "positive": [ "mx.zoho.com", "mx2.zoho.com", "mx3.zoho.com" ], "negative": [ "x.mx.zoho.com", "mx.zoho.com.example.org" ] }, "evidence_basis": "provider_documented_pattern" }, { "id": "zoho-mail-spf", "provider_id": "zoho", "service": "Zoho Mail SPF", "role": "spf_reference", "match_type": "exact", "patterns": [ "zohomail.com" ], "status": "active", "source": { "url": "https://www.zoho.com/mail/help/adminconsole/cloudflare.html", "title": "Cloudflare DNS - TXT, CNAME, MX Records", "basis": "Zoho documents include:zohomail.com for its mail service.", "reviewed_on": "2026-09-06", "review_due": "2027-03-06" }, "fixtures": { "positive": [ "zohomail.com" ], "negative": [ "x.zohomail.com", "zohomail.com.example.org" ] }, "evidence_basis": "provider_documented_pattern" }, { "id": "zoneedit-ns", "provider_id": "zoneedit", "service": "Managed DNS", "role": "dns_hosting", "match_type": "hostname_suffix", "patterns": [ "zoneedit.com" ], "status": "active", "source": { "url": "https://forum.zoneedit.com/threads/nameserver-ns1-zoneedit-com-or-dns1-zoneedit-com.5822/", "title": "ZoneEdit nameserver naming: administrator clarification", "basis": "A ZoneEdit staff administrator confirms dns1/2/3.zoneedit.com and legacy ns-prefixed nameservers. The rule associates observed NS endpoints under that service namespace.", "reviewed_on": "2026-09-06", "review_due": "2027-03-06" }, "fixtures": { "positive": [ "dns1.zoneedit.com", "ns17.zoneedit.com" ], "negative": [ "zoneedit.com", "notzoneedit.com", "dns1.zoneedit.com.example.org" ] }, "evidence_basis": "provider_documented_pattern" }, { "id": "atmail-cloud-au-mx", "provider_id": "atmail", "service": "Atmail Cloud mail routing (Australia)", "role": "inbound_mail", "match_type": "exact", "patterns": [ "mx-10.au-east.atmailcloud.com", "mx-20.au-east.atmailcloud.com" ], "status": "active", "source": { "url": "https://www.atmail.com/wp-content/uploads/2020/10/FAQ-atmail-cloud-Aug2019.pdf", "title": "FAQ: atmail cloud", "basis": "Atmail states that domains can have their MX records pointed to atmail cloud. The rule is restricted to the two Australian atmailcloud.com MX targets retained in the pinned .auDO evidence; it does not generalise to every Atmail hostname or infer reseller identity.", "reviewed_on": "2026-09-07", "review_due": "2027-03-07" }, "fixtures": { "positive": [ "mx-10.au-east.atmailcloud.com", "mx-20.au-east.atmailcloud.com" ], "negative": [ "x.mx-10.au-east.atmailcloud.com", "mx-10.au-east.atmailcloud.com.example.org", "smtp-us.atmailcloud.com" ] }, "evidence_basis": "provider_documented_pattern" }, { "id": "squarespace-dns-ns", "provider_id": "squarespace", "service": "Managed DNS", "role": "dns_hosting", "match_type": "hostname_suffix", "patterns": [ "squarespacedns.com" ], "status": "active", "source": { "url": "https://support.squarespace.com/hc/en-us/articles/4404183898125-Change-or-reset-your-domain-s-nameservers", "title": "Change or reset your domain's nameservers", "basis": "Squarespace documents that its default nameservers may end in .squarespacedns.com and that these nameservers can appear on third-party domains. The rule labels DNS-hosting infrastructure only and does not infer registrar or website hosting.", "reviewed_on": "2026-09-07", "review_due": "2027-03-07" }, "fixtures": { "positive": [ "connect1.squarespacedns.com", "connect2.squarespacedns.com" ], "negative": [ "squarespacedns.com", "notsquarespacedns.com", "connect1.squarespacedns.com.example.org" ] }, "evidence_basis": "provider_documented_pattern" }, { "id": "telstra-internet-direct-ns", "provider_id": "telstra", "service": "Internet Direct DNS", "role": "dns_hosting", "match_type": "exact", "patterns": [ "ns0.telstra.net", "ns1.telstra.net" ], "status": "active", "source": { "url": "https://www.telstra.com.au/content/dam/tcom/business-enterprise/support/pdf/business-custdata-user-guide.pdf", "title": "CustData User Guide — Domain Name Service", "basis": "Telstra states that Primary DNS hosts a domain on Telstra Internet Direct nameservers and explicitly gives ns0.telstra.net and ns1.telstra.net as the required delegation targets.", "reviewed_on": "2026-09-07", "review_due": "2027-03-07" }, "fixtures": { "positive": [ "ns0.telstra.net", "NS1.TELSTRA.NET." ], "negative": [ "telstra.net", "x.ns0.telstra.net", "ns0.telstra.net.example.org" ] }, "evidence_basis": "provider_documented_pattern" }, { "id": "trellix-email-security-cloud-mx", "provider_id": "trellix", "service": "Email Security Cloud", "role": "inbound_mail", "match_type": "exact", "patterns": [ "mx.us.email.fireeyecloud.com", "mx.emea.email.fireeyecloud.com", "mx.ap.email.fireeyecloud.com", "mx.us.etp.fireeyegov.com", "mx.ca.etp.fireeyecloud.com" ], "status": "active", "source": { "url": "https://docs-be.trellix.com/bundle/etp_ig_gmail_2022-3_pdf/raw/resource/enus/ETP_IG_Gmail_2022.3_pdf.pdf?save_local=true", "title": "Email Security - Cloud Gmail Integration Guide 2022.3", "basis": "The Trellix-hosted FireEye guide publishes the five regional Email Security Cloud server names and states that the configuration uses pre-configured Email Security Cloud MX records for failover. The EMEA endpoint is retained in .auDO history for Optus.", "reviewed_on": "2026-09-07", "review_due": "2027-03-07" }, "fixtures": { "positive": [ "mx.us.email.fireeyecloud.com", "mx.emea.email.fireeyecloud.com", "mx.ap.email.fireeyecloud.com", "mx.us.etp.fireeyegov.com", "mx.ca.etp.fireeyecloud.com" ], "negative": [ "email.fireeyecloud.com", "x.mx.emea.email.fireeyecloud.com", "mx.emea.email.fireeyecloud.com.example.org" ] }, "evidence_basis": "provider_documented_pattern" }, { "id": "webcentral-netregistry-ns", "provider_id": "webcentral", "service": "Managed DNS", "role": "dns_hosting", "match_type": "exact", "patterns": [ "ns1.netregistry.net", "ns2.netregistry.net", "ns3.netregistry.net" ], "status": "active", "source": { "url": "https://support.webcentral.au/docs/making-the-switch-to-webcentral", "title": "Making the Switch to Webcentral", "basis": "Webcentral explicitly publishes ns1.netregistry.net, ns2.netregistry.net and ns3.netregistry.net after records are moved to its DNS editor. The rule does not copy .auDO’s broader legacy substring markers or include separate cPanel hosting nameservers.", "reviewed_on": "2026-09-07", "review_due": "2027-03-07" }, "fixtures": { "positive": [ "ns1.netregistry.net", "ns2.netregistry.net", "ns3.netregistry.net" ], "negative": [ "x.ns1.netregistry.net", "ns1.netregistry.net.example.org", "ns1.mysecurecloudhost.com" ] }, "evidence_basis": "provider_documented_pattern" }, { "id": "digital-pacific-dns", "provider_id": "digital-pacific", "service": "Authoritative and hosting DNS", "role": "dns_hosting", "match_type": "exact", "patterns": [ "ns1.digitalpacific.com.au", "ns2.digitalpacific.com.au", "ns3.digitalpacific.com", "ns4.digitalpacific.com", "ns1.aussiedns.net.au", "ns2.aussiedns.net.au", "ns3.aussiedns.net.au", "ns1.auserver.com.au", "ns2.auserver.com.au" ], "status": "active", "source": { "url": "https://support.digitalpacific.com.au/en/knowledgebase/article/what-are-the-digital-pacific-name-servers", "title": "What are the Digital Pacific Nameservers?", "basis": "Digital Pacific publishes the exact shared-hosting, DNS Manager and reseller-hosting nameserver targets used by its services.", "reviewed_on": "2026-09-08", "review_due": "2027-03-08" }, "fixtures": { "positive": [ "ns1.digitalpacific.com.au", "ns2.digitalpacific.com.au", "ns3.digitalpacific.com", "ns4.digitalpacific.com", "ns1.aussiedns.net.au", "ns2.aussiedns.net.au", "ns3.aussiedns.net.au", "ns1.auserver.com.au", "ns2.auserver.com.au" ], "negative": [ "x.ns1.digitalpacific.com.au", "ns1.digitalpacific.com.au.example.org" ] }, "evidence_basis": "provider_documented_pattern" }, { "id": "micron21-dns", "provider_id": "micron21", "service": "VDNS and FastDNS", "role": "dns_hosting", "match_type": "exact", "patterns": [ "ns1.vdns.au", "ns2.vdns.au", "ns1.fastdns.com.au", "ns2.fastdns.com.au", "ns3.fastdns.com.au", "ns4.fastdns.com.au" ], "status": "active", "source": { "url": "https://support.micron21.com/kb/articles/updating-nameserver-delegation-in-domain-panel", "title": "Updating nameserver delegation in Domain Panel", "basis": "Micron21 publishes the exact VDNS and FastDNS nameservers used for its Domain Panel and shared web hosting services.", "reviewed_on": "2026-09-08", "review_due": "2027-03-08" }, "fixtures": { "positive": [ "ns1.vdns.au", "ns2.vdns.au", "ns1.fastdns.com.au", "ns2.fastdns.com.au", "ns3.fastdns.com.au", "ns4.fastdns.com.au" ], "negative": [ "x.ns1.vdns.au", "ns1.vdns.au.example.org" ] }, "evidence_basis": "provider_documented_pattern" }, { "id": "crucial-dns", "provider_id": "crucial", "service": "Authoritative and hosting DNS", "role": "dns_hosting", "match_type": "exact", "patterns": [ "nssyd01.crucial.com.au", "nsdal01.crucial.com.au", "nssyd02.crucial.com.au", "nssyd01.aumanaged.com", "nsdal01.aumanaged.com", "nssyd02.aumanaged.com", "nssyd01.clusterdns.net", "nsdal01.clusterdns.net", "nssyd02.clusterdns.net", "ns1.crucialdns.com", "ns2.crucialdns.com", "ns3.crucialdns.com" ], "status": "active", "source": { "url": "https://control.crucial.com.au/knowledgebase.php?id=340-what-are-crucials-name-servers", "title": "What are Crucial's Name Servers?", "basis": "Crucial publishes exact service-specific authoritative nameserver targets across four DNS/hosting contexts.", "reviewed_on": "2026-09-08", "review_due": "2027-03-08" }, "fixtures": { "positive": [ "nssyd01.crucial.com.au", "nsdal01.crucial.com.au", "nssyd02.crucial.com.au", "nssyd01.aumanaged.com", "nsdal01.aumanaged.com", "nssyd02.aumanaged.com", "nssyd01.clusterdns.net", "nsdal01.clusterdns.net", "nssyd02.clusterdns.net", "ns1.crucialdns.com", "ns2.crucialdns.com", "ns3.crucialdns.com" ], "negative": [ "x.nssyd01.crucial.com.au", "nssyd01.crucial.com.au.example.org" ] }, "evidence_basis": "provider_documented_pattern" }, { "id": "conetix-dns", "provider_id": "conetix", "service": "Authoritative DNS", "role": "dns_hosting", "match_type": "exact", "patterns": [ "ns1.conetix.com", "ns2.conetix.com" ], "status": "active", "source": { "url": "https://conetix.com.au/support/what-are-the-conetix-nameservers/", "title": "What Are the Conetix Nameservers for DNS?", "basis": "Conetix explicitly publishes ns1.conetix.com and ns2.conetix.com as its DNS nameservers.", "reviewed_on": "2026-09-08", "review_due": "2027-03-08" }, "fixtures": { "positive": [ "ns1.conetix.com", "ns2.conetix.com" ], "negative": [ "x.ns1.conetix.com", "ns1.conetix.com.example.org" ] }, "evidence_basis": "provider_documented_pattern" }, { "id": "dreamit-host-dns", "provider_id": "dreamit-host", "service": "Web Hosting DNS", "role": "dns_hosting", "match_type": "exact", "patterns": [ "ns1.hosting-cloud.net", "ns2.hosting-cloud.net", "ns3.hosting-cloud.net", "ns4.hosting-cloud.net" ], "status": "active", "source": { "url": "https://help.dreamithost.com.au/knowledgebase/article/web-hosting-nameservers", "title": "Web Hosting Nameservers", "basis": "DreamIT Host publishes ns1 through ns4.hosting-cloud.net as its web-hosting nameservers.", "reviewed_on": "2026-09-08", "review_due": "2027-03-08" }, "fixtures": { "positive": [ "ns1.hosting-cloud.net", "ns2.hosting-cloud.net", "ns3.hosting-cloud.net", "ns4.hosting-cloud.net" ], "negative": [ "x.ns1.hosting-cloud.net", "ns1.hosting-cloud.net.example.org" ] }, "evidence_basis": "provider_documented_pattern" }, { "id": "dreamit-host-email-dns", "provider_id": "dreamit-host", "service": "Email Hosting DNS", "role": "dns_hosting", "match_type": "exact", "patterns": [ "ens1.hosting-cloud.net", "ens2.hosting-cloud.net", "ens3.hosting-cloud.net", "ens4.hosting-cloud.net" ], "status": "active", "source": { "url": "https://help.dreamithost.com.au/knowledgebase/article/email-hosting-nameservers", "title": "Email Hosting Nameservers", "basis": "DreamIT Host publishes ens1 through ens4.hosting-cloud.net as its email-hosting nameservers.", "reviewed_on": "2026-09-08", "review_due": "2027-03-08" }, "fixtures": { "positive": [ "ens1.hosting-cloud.net", "ens2.hosting-cloud.net", "ens3.hosting-cloud.net", "ens4.hosting-cloud.net" ], "negative": [ "x.ens1.hosting-cloud.net", "ens1.hosting-cloud.net.example.org" ] }, "evidence_basis": "provider_documented_pattern" }, { "id": "panthur-dns", "provider_id": "panthur", "service": "Hosting and DNS Manager", "role": "dns_hosting", "match_type": "exact", "patterns": [ "ns1.panthur.com", "ns2.panthur.com", "ns3.panthur.com", "ns4.panthur.com", "ns1.yourdns.com.au", "ns2.yourdns.com.au" ], "status": "active", "source": { "url": "https://support.panthur.com.au/en/knowledgebase/article/what-name-servers-should-i-use-for-my-domain-name", "title": "What Name Servers should I use for my domain name?", "basis": "Panthur publishes ns1 through ns4.panthur.com for hosted services and ns1/ns2.yourdns.com.au for its DNS Manager.", "reviewed_on": "2026-09-08", "review_due": "2027-03-08" }, "fixtures": { "positive": [ "ns1.panthur.com", "ns2.panthur.com", "ns3.panthur.com", "ns4.panthur.com", "ns1.yourdns.com.au", "ns2.yourdns.com.au" ], "negative": [ "x.ns1.panthur.com", "ns1.panthur.com.example.org" ] }, "evidence_basis": "provider_documented_pattern" }, { "id": "synergy-wholesale-hosting-dns", "provider_id": "synergy-wholesale", "service": "cPanel hosting DNS", "role": "dns_hosting", "match_type": "exact", "patterns": [ "ns1.syd2.hostyourservices.net", "ns2.syd2.hostyourservices.net", "ns1.syd3.hostyourservices.net", "ns2.syd3.hostyourservices.net", "ns1.syd4.hostyourservices.net", "ns2.syd4.hostyourservices.net", "ns1.syd5.hostyourservices.net", "ns2.syd5.hostyourservices.net", "ns1.syd6.hostyourservices.net", "ns2.syd6.hostyourservices.net", "ns1.syd7.hostyourservices.net", "ns2.syd7.hostyourservices.net" ], "status": "active", "source": { "url": "https://synergywholesale.com/support-centre/what-are-the-synergy-wholesale-cpanel-web-hosting-nameservers/", "title": "What are the Synergy Wholesale cPanel Web Hosting Nameservers?", "basis": "Synergy Wholesale publishes the exact hostyourservices.net nameserver pairs assigned to its documented Sydney hosting clusters.", "reviewed_on": "2026-09-08", "review_due": "2027-03-08" }, "fixtures": { "positive": [ "ns1.syd2.hostyourservices.net", "ns2.syd2.hostyourservices.net", "ns1.syd3.hostyourservices.net", "ns2.syd3.hostyourservices.net", "ns1.syd4.hostyourservices.net", "ns2.syd4.hostyourservices.net", "ns1.syd5.hostyourservices.net", "ns2.syd5.hostyourservices.net", "ns1.syd6.hostyourservices.net", "ns2.syd6.hostyourservices.net", "ns1.syd7.hostyourservices.net", "ns2.syd7.hostyourservices.net" ], "negative": [ "x.ns1.syd2.hostyourservices.net", "ns1.syd2.hostyourservices.net.example.org" ] }, "evidence_basis": "provider_documented_pattern" }, { "id": "obble-dns", "provider_id": "obble", "service": "Hosting DNS", "role": "dns_hosting", "match_type": "exact", "patterns": [ "ns1.obble.com.au", "ns2.obble.com.au" ], "status": "active", "source": { "url": "https://obble.com.au/billing/index.php?rp=%2Fknowledgebase%2F1%2FUsing-your-domain-with-our-servers.html", "title": "Using your domain with our servers", "basis": "Obble instructs customers to use ns1.obble.com.au and ns2.obble.com.au to point domains at its hosting service.", "reviewed_on": "2026-09-08", "review_due": "2027-03-08" }, "fixtures": { "positive": [ "ns1.obble.com.au", "ns2.obble.com.au" ], "negative": [ "x.ns1.obble.com.au", "ns1.obble.com.au.example.org" ] }, "evidence_basis": "provider_documented_pattern" }, { "id": "sap-successfactors-spf", "provider_id": "sap", "service": "SuccessFactors data-centre SPF", "role": "spf_reference", "match_type": "exact", "patterns": [ "_spf-dc2.successfactors.com", "_spf-dc4.sapsf.com", "_spf-dc8.sapsf.com", "_spf-dc10.sapsf.com", "_spf-dc11.sapsf.com", "_spf-dc12.successfactors.com", "_spf-dc15.sapsf.cn", "_spf-dc17.sapsf.com", "_spf-dc19.sapsf.com", "_spf-dc22.sapsf.com", "_spf-dc23.sapsf.com", "_spf-dc25.sapsf.com", "_spf-dc26.sapsf.eu", "_spf-dc41.sapsf.com", "_spf-dc43.sapsf.com", "_spf-dc44.sapsf.com", "_spf-dc47.sapsf.com", "_spf-dc48.sapsf.com", "_spf-dc49.sapsf.com", "_spf-dc50.sapsf.com", "_spf-dc51.sapsf.com", "_spf-dc54.sapsf.eu", "_spf-dc55.sapsf.eu", "_spf-dc56.sapsf.eu", "_spf-dc61.sapsf.com", "_spf-dc95.sapsf.com" ], "status": "active", "source": { "url": "https://help.sap.com/docs/successfactors-onboarding/implementing-onboarding/allowlist-methods-for-emails-from-sap-successfactors-onboarding", "title": "Allowlist Methods for Emails from SAP SuccessFactors Onboarding", "basis": "SAP publishes the data-centre-specific SPF include values, including DC10/DC66 in Sydney. The rule records literal provider references and does not evaluate SPF authorization.", "reviewed_on": "2026-09-08", "review_due": "2027-03-08" }, "fixtures": { "positive": [ "_spf-dc2.successfactors.com", "_spf-dc4.sapsf.com", "_spf-dc8.sapsf.com", "_spf-dc10.sapsf.com", "_spf-dc11.sapsf.com", "_spf-dc12.successfactors.com", "_spf-dc15.sapsf.cn", "_spf-dc17.sapsf.com", "_spf-dc19.sapsf.com", "_spf-dc22.sapsf.com", "_spf-dc23.sapsf.com", "_spf-dc25.sapsf.com", "_spf-dc26.sapsf.eu", "_spf-dc41.sapsf.com", "_spf-dc43.sapsf.com", "_spf-dc44.sapsf.com", "_spf-dc47.sapsf.com", "_spf-dc48.sapsf.com", "_spf-dc49.sapsf.com", "_spf-dc50.sapsf.com", "_spf-dc51.sapsf.com", "_spf-dc54.sapsf.eu", "_spf-dc55.sapsf.eu", "_spf-dc56.sapsf.eu", "_spf-dc61.sapsf.com", "_spf-dc95.sapsf.com" ], "negative": [ "x._spf-dc2.successfactors.com", "_spf-dc2.successfactors.com.example.org" ] }, "evidence_basis": "provider_documented_pattern" }, { "id": "salesforce-marketing-cloud-spf", "provider_id": "salesforce", "service": "Marketing Cloud Engagement SPF", "role": "spf_reference", "match_type": "exact", "patterns": [ "cust-spf.exacttarget.com" ], "status": "active", "source": { "url": "https://help.salesforce.com/s/articleView?id=mktg.mc_es_sender_policy_framework_faq.htm&language=en_US&type=5", "title": "Sender Policy Framework and Authentication FAQs", "basis": "Salesforce explicitly documents include:cust-spf.exacttarget.com for Marketing Cloud Engagement sender authentication.", "reviewed_on": "2026-09-08", "review_due": "2027-03-08" }, "fixtures": { "positive": [ "cust-spf.exacttarget.com" ], "negative": [ "x.cust-spf.exacttarget.com", "cust-spf.exacttarget.com.example.org" ] }, "evidence_basis": "provider_documented_pattern" }, { "id": "hubspot-email-spf", "provider_id": "hubspot", "service": "Marketing email SPF", "role": "spf_reference", "match_type": "hostname_suffix", "patterns": [ "hubspotemail.net" ], "status": "active", "source": { "url": "https://knowledge.hubspot.com/marketing-email/troubleshoot-email-authentication-issues", "title": "Troubleshoot email authentication issues", "basis": "HubSpot documents account-specific SPF include values below hubspotemail.net, including numbered spf01/spf03-style hosts. The suffix rule labels a literal reference under that provider-controlled SPF namespace.", "reviewed_on": "2026-09-08", "review_due": "2027-03-08" }, "fixtures": { "positive": [ "3481800.spf03.hubspotemail.net", "43576715.spf06.hubspotemail.net", "441916582.spf07.hubspotemail.net" ], "negative": [ "hubspotemail.net", "nothubspotemail.net", "3481800.spf03.hubspotemail.net.example.org" ] }, "evidence_basis": "provider_documented_pattern" }, { "id": "qualtrics-spf", "provider_id": "qualtrics", "service": "Survey email SPF", "role": "spf_reference", "match_type": "exact", "patterns": [ "_spf.qualtrics.com" ], "status": "active", "source": { "url": "https://www.qualtrics.com/support/survey-platform/distributions-module/email-distribution/using-a-custom-from-address/", "title": "Using a Custom From Address", "basis": "Qualtrics explicitly documents include:_spf.qualtrics.com for custom sending domains.", "reviewed_on": "2026-09-08", "review_due": "2027-03-08" }, "fixtures": { "positive": [ "_spf.qualtrics.com" ], "negative": [ "x._spf.qualtrics.com", "_spf.qualtrics.com.example.org" ] }, "evidence_basis": "provider_documented_pattern" }, { "id": "oracle-email-delivery-spf", "provider_id": "oracle", "service": "OCI Email Delivery SPF", "role": "spf_reference", "match_type": "exact", "patterns": [ "rp.oracleemaildelivery.com", "ap.rp.oracleemaildelivery.com", "eu.rp.oracleemaildelivery.com" ], "status": "active", "source": { "url": "https://docs.oracle.com/en-us/iaas/Content/Email/Tasks/configurespf.htm", "title": "Configuring SPF", "basis": "Oracle publishes the Americas, Asia/Pacific and Europe Email Delivery SPF include domains.", "reviewed_on": "2026-09-08", "review_due": "2027-03-08" }, "fixtures": { "positive": [ "rp.oracleemaildelivery.com", "ap.rp.oracleemaildelivery.com", "eu.rp.oracleemaildelivery.com" ], "negative": [ "x.rp.oracleemaildelivery.com", "rp.oracleemaildelivery.com.example.org" ] }, "evidence_basis": "provider_documented_pattern" }, { "id": "broadcom-messagelabs-spf", "provider_id": "broadcom", "service": "Symantec Email Security.cloud SPF", "role": "spf_reference", "match_type": "exact", "patterns": [ "spf.messagelabs.com" ], "status": "active", "source": { "url": "https://knowledge.broadcom.com/external/article/178680/enforce-spf-for-a-domain-protected-by-em.html", "title": "Enforce SPF for a domain protected by Email Security.cloud", "basis": "Broadcom documents spf.messagelabs.com in Email Security.cloud SPF guidance.", "reviewed_on": "2026-09-08", "review_due": "2027-03-08" }, "fixtures": { "positive": [ "spf.messagelabs.com" ], "negative": [ "x.spf.messagelabs.com", "spf.messagelabs.com.example.org" ] }, "evidence_basis": "provider_documented_pattern" }, { "id": "swift-digital-spf", "provider_id": "swift-digital", "service": "Digital communications SPF", "role": "spf_reference", "match_type": "exact", "patterns": [ "spf.swiftdigital.com.au" ], "status": "active", "source": { "url": "https://support.swiftdigital.com.au/hc/en-us/article_attachments/360007040996", "title": "Deliverability Setup", "basis": "Swift Digital instructs customers to include spf.swiftdigital.com.au in sending-domain SPF.", "reviewed_on": "2026-09-08", "review_due": "2027-03-08" }, "fixtures": { "positive": [ "spf.swiftdigital.com.au" ], "negative": [ "x.spf.swiftdigital.com.au", "spf.swiftdigital.com.au.example.org" ] }, "evidence_basis": "provider_documented_pattern" }, { "id": "servicenow-spf", "provider_id": "servicenow", "service": "Platform notification SPF", "role": "spf_reference", "match_type": "exact", "patterns": [ "service-now.com" ], "status": "active", "source": { "url": "https://www.servicenow.com/community/developer-blog/whitelisting-emails-sent-from-the-servicenow-infrastructure/ba-p/2287958", "title": "Whitelisting emails sent from the ServiceNow infrastructure", "basis": "ServiceNow-hosted guidance points administrators to the service-now.com SPF record and its sub-records for platform-originated email.", "reviewed_on": "2026-09-08", "review_due": "2027-03-08" }, "fixtures": { "positive": [ "service-now.com" ], "negative": [ "x.service-now.com", "service-now.com.example.org" ] }, "evidence_basis": "provider_documented_pattern" }, { "id": "exclaimer-global-spf", "provider_id": "exclaimer", "service": "Legacy/global signature service SPF", "role": "spf_reference", "match_type": "exact", "patterns": [ "spf.exclaimer.net" ], "status": "active", "source": { "url": "https://support.exclaimer.com/hc/en-gb/articles/4405827624337-Exclaimer-Simple-Mail-Transfer-Protocol-SMTP-host-list-and-Internet-Protocol-IP-Whitelist", "title": "Exclaimer SMTP host list and IP whitelist", "basis": "Current Exclaimer guidance shows the historical/global include:spf.exclaimer.net example beside current region-specific SPF records. The rule labels the observed reference without replacing the existing regional rule.", "reviewed_on": "2026-09-08", "review_due": "2027-03-08" }, "fixtures": { "positive": [ "spf.exclaimer.net" ], "negative": [ "x.spf.exclaimer.net", "spf.exclaimer.net.example.org" ] }, "evidence_basis": "provider_documented_pattern" }, { "id": "knowbe4-spf", "provider_id": "knowbe4", "service": "Security awareness simulation SPF", "role": "spf_reference", "match_type": "exact", "patterns": [ "_spf.psm.knowbe4.com" ], "status": "active", "source": { "url": "https://support.knowbe4.com/hc/en-us/articles/115003254328-Add-KnowBe4-to-Your-Sender-Policy-Framework-SPF-Record", "title": "Add KnowBe4 to Your Sender Policy Framework (SPF) Record", "basis": "KnowBe4 explicitly documents include:_spf.psm.knowbe4.com for simulated-phishing email sent on behalf of customer domains.", "reviewed_on": "2026-09-08", "review_due": "2027-03-08" }, "fixtures": { "positive": [ "_spf.psm.knowbe4.com" ], "negative": [ "x._spf.psm.knowbe4.com", "_spf.psm.knowbe4.com.example.org" ] }, "evidence_basis": "provider_documented_pattern" }, { "id": "formassembly-spf", "provider_id": "formassembly", "service": "Notification email SPF", "role": "spf_reference", "match_type": "exact", "patterns": [ "spf1.formassembly.com" ], "status": "active", "source": { "url": "https://help.formassembly.com/help/email-notification-security-and-authentication", "title": "Email Notification Security and Authentication", "basis": "FormAssembly explicitly instructs customers to add include:spf1.formassembly.com for notifications and auto-responder email.", "reviewed_on": "2026-09-08", "review_due": "2027-03-08" }, "fixtures": { "positive": [ "spf1.formassembly.com" ], "negative": [ "x.spf1.formassembly.com", "spf1.formassembly.com.example.org" ] }, "evidence_basis": "provider_documented_pattern" }, { "id": "campaign-monitor-sending-domain-spf", "provider_id": "campaign-monitor", "service": "Campaign sending-domain SPF references", "role": "spf_reference", "match_type": "exact", "patterns": [ "cmail1.com", "cmail2.com", "cmail3.com", "cmail4.com", "cmail5.com", "cmail6.com", "cmail7.com", "cmail8.com", "cmail9.com", "cmail10.com", "cmail11.com", "cmail12.com", "cmail13.com", "cmail14.com", "cmail15.com", "cmail16.com", "cmail17.com", "cmail18.com", "cmail19.com", "cmail20.com" ], "status": "active", "source": { "url": "https://help.campaignmonitor.com/articles/Knowledge/allowlist-campaign-monitors-addresses", "title": "Allowlist Campaign Monitor’s addresses", "basis": "Campaign Monitor publishes cmail1.com through cmail20.com as sending domains. The existing recommended _spf.createsend.com rule remains separate; this rule labels literal SPF references to the documented sending-domain family.", "reviewed_on": "2026-09-08", "review_due": "2027-03-08" }, "fixtures": { "positive": [ "cmail1.com", "cmail2.com", "cmail3.com", "cmail4.com", "cmail5.com", "cmail6.com", "cmail7.com", "cmail8.com", "cmail9.com", "cmail10.com", "cmail11.com", "cmail12.com", "cmail13.com", "cmail14.com", "cmail15.com", "cmail16.com", "cmail17.com", "cmail18.com", "cmail19.com", "cmail20.com" ], "negative": [ "x.cmail1.com", "cmail1.com.example.org" ] }, "evidence_basis": "provider_documented_pattern" }, { "id": "help-scout-legacy-spf", "provider_id": "help-scout", "service": "Legacy sending SPF reference", "role": "spf_reference", "match_type": "exact", "patterns": [ "helpscoutemail.com" ], "status": "active", "source": { "url": "https://docs.helpscout.com/article/58-spf-records", "title": "Changes to SPF Requirements With Help Scout", "basis": "Help Scout documents include:helpscoutemail.com as its former SPF entry and explains that it can now be removed. The rule identifies the retained literal provider reference without recommending it.", "reviewed_on": "2026-09-08", "review_due": "2027-03-08" }, "fixtures": { "positive": [ "helpscoutemail.com" ], "negative": [ "x.helpscoutemail.com", "helpscoutemail.com.example.org" ] }, "evidence_basis": "provider_documented_pattern" }, { "id": "adobe-marketo-spf", "provider_id": "adobe", "service": "Marketo Engage SPF", "role": "spf_reference", "match_type": "exact", "patterns": [ "mktomail.com" ], "status": "active", "source": { "url": "https://experienceleague.adobe.com/en/docs/marketo/using/product-docs/email-marketing/deliverability/set-up-spf-and-dkim-for-your-email-deliverability", "title": "Set up SPF and DKIM for your Email Deliverability", "basis": "Adobe Marketo Engage explicitly documents include:mktomail.com for customer sending domains.", "reviewed_on": "2026-09-08", "review_due": "2027-03-08" }, "fixtures": { "positive": [ "mktomail.com" ], "negative": [ "x.mktomail.com", "mktomail.com.example.org" ] }, "evidence_basis": "provider_documented_pattern" }, { "id": "mailchimp-transactional-spf", "provider_id": "mailchimp", "service": "Mailchimp Transactional SPF", "role": "spf_reference", "match_type": "exact", "patterns": [ "spf.mandrillapp.com" ], "status": "active", "source": { "url": "https://mandrill.zendesk.com/hc/en-us/articles/360038798314-How-can-my-recipients-add-Transactional-Email-s-IP-addresses-to-a-safelist", "title": "How can my recipients add Transactional Email's IP addresses to a safelist? | Mailchimp Transactional", "basis": "Mailchimp Transactional identifies spf.mandrillapp.com as the TXT record containing its shared sending IP range. The rule is deliberately exact and does not extend to other mandrillapp.com infrastructure.", "reviewed_on": "2026-09-09", "review_due": "2027-03-09" }, "fixtures": { "positive": [ "spf.mandrillapp.com", "SPF.MANDRILLAPP.COM." ], "negative": [ "mandrillapp.com", "_spf.mandrillapp.com", "smtp.mandrillapp.com", "x.spf.mandrillapp.com", "spf.mandrillapp.com.example.org", "rnmk.com" ] }, "evidence_basis": "provider_documented_pattern" }, { "id": "oracle-b2c-service-spf", "provider_id": "oracle", "service": "Oracle B2C Service outbound email SPF", "role": "spf_reference", "match_type": "exact", "patterns": [ "rnmk.com" ], "status": "active", "source": { "url": "https://cx.rightnow.com/app/answers/detail/a_id/331/~/setting-up-mailboxes-in-b2c-service", "title": "Setting up mailboxes in B2C Service | Oracle B2C Service", "basis": "Oracle B2C Service instructs customers using branded Envelope From/Bounce domains to include rnmk.com in SPF so Oracle can send on their behalf. The rule is deliberately exact and does not extend to rnmk.com child hostnames.", "reviewed_on": "2026-09-09", "review_due": "2027-03-09" }, "fixtures": { "positive": [ "rnmk.com", "RNMK.COM." ], "negative": [ "spf-a.rnmk.com", "spf-b.rnmk.com", "x.rnmk.com", "rnmk.com.example.org", "spf.mandrillapp.com" ] }, "evidence_basis": "provider_documented_pattern" }, { "id": "red-sift-ondmarc-dynamic-spf", "provider_id": "red-sift", "service": "Red Sift OnDMARC Dynamic SPF", "role": "spf_reference", "match_type": "exact", "patterns": [ "_u.redcross.org.au._spf.smart.ondmarc.com", "_u.unicef.org.au._spf.smart.ondmarc.com" ], "status": "active", "source": { "url": "https://knowledge.ondmarc.redsift.com/en/articles/3328695-how-to-configure-dynamic-spf", "title": "How to configure Dynamic SPF | OnDMARC Help Center", "basis": "Red Sift OnDMARC documents the _u.._spf.smart.ondmarc.com Smart Include form. The conformance proposal remains exact to the two observed .auDO markers because provider-resolution-v1 cannot express the documented leading _u plus variable customer-domain structure without broadening to arbitrary children of _spf.smart.ondmarc.com.", "reviewed_on": "2026-09-09", "review_due": "2027-03-09" }, "fixtures": { "positive": [ "_u.redcross.org.au._spf.smart.ondmarc.com", "_U.REDCROSS.ORG.AU._SPF.SMART.ONDMARC.COM.", "_u.unicef.org.au._spf.smart.ondmarc.com" ], "negative": [ "smart.ondmarc.com", "_spf.smart.ondmarc.com", "foo._spf.smart.ondmarc.com", "_u.redcross.org.au._spf.smart.ondmarc.com.example.org", "4501nxl41s.powerspf.com", "salvationarmy.org.au._nspf.vali.email" ] }, "evidence_basis": "provider_documented_pattern" }, { "id": "powerdmarc-powerspf", "provider_id": "powerdmarc", "service": "PowerDMARC PowerSPF hosted SPF", "role": "spf_reference", "match_type": "hostname_suffix", "patterns": [ "powerspf.com" ], "status": "active", "source": { "url": "https://powerdmarc.com/spf-macros-everything-you-need-to-know/", "title": "SPF Macros: The Complete Guide For IT Leaders | PowerDMARC", "basis": "PowerDMARC documents token-shaped PowerSPF hostnames under powerspf.com, including abcde12345.powerspf.com and related PowerSPF forms. The role-scoped label-boundary suffix captures documented hosted-SPF children without matching the bare domain or appended-domain spoofs.", "reviewed_on": "2026-09-09", "review_due": "2027-03-09" }, "fixtures": { "positive": [ "4501nxl41s.powerspf.com", "4501NXL41S.POWERSPF.COM.", "abcde12345.powerspf.com", "macrospf.powerspf.com" ], "negative": [ "powerspf.com", "examplepowerspf.com", "powerspf.com.example.org", "_u.redcross.org.au._spf.smart.ondmarc.com", "salvationarmy.org.au._nspf.vali.email", "sent-via.netsuite.com" ] }, "evidence_basis": "provider_documented_pattern" }, { "id": "valimail-legacy-nspf", "provider_id": "valimail", "service": "Valimail legacy NSPF reference", "role": "spf_reference", "match_type": "hostname_suffix", "patterns": [ "_nspf.vali.email" ], "status": "active", "source": { "url": "https://support.valimail.com/en/articles/9143142-valimail-spf-macro-syntax", "title": "Valimail SPF Macro Syntax | Valimail Help Center", "basis": "Valimail explicitly documents ._nspf.vali.email as an older SPF macro component. The label-boundary suffix models the documented customer-domain labels to the left while preserving that the form is legacy, not current recommended configuration.", "reviewed_on": "2026-09-09", "review_due": "2027-03-09" }, "fixtures": { "positive": [ "salvationarmy.org.au._nspf.vali.email", "SALVATIONARMY.ORG.AU._NSPF.VALI.EMAIL.", "example.com._nspf.vali.email" ], "negative": [ "_nspf.vali.email", "vali.email", "example.com._spf.vali.email", "salvationarmy.org.au._nspf.vali.email.example.org", "4501nxl41s.powerspf.com", "sent-via.netsuite.com" ] }, "evidence_basis": "provider_documented_pattern" }, { "id": "oracle-netsuite-spf", "provider_id": "oracle", "service": "Oracle NetSuite outbound email SPF", "role": "spf_reference", "match_type": "exact", "patterns": [ "sent-via.netsuite.com" ], "status": "active", "source": { "url": "https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/bridgehead_4820740297.html", "title": "NetSuite Applications Suite - Sender Policy Framework (SPF) | Oracle", "basis": "Oracle explicitly instructs NetSuite customers to include sent-via.netsuite.com when a NetSuite SPF reference is required. The proposal is exact and excludes adjacent NetSuite sender namespaces with different documented purposes.", "reviewed_on": "2026-09-09", "review_due": "2027-03-09" }, "fixtures": { "positive": [ "sent-via.netsuite.com", "SENT-VIA.NETSUITE.COM." ], "negative": [ "netsuite.com", "mailsenders.netsuite.com", "x.sent-via.netsuite.com", "sent-via.netsuite.com.example.org", "rnmk.com", "relay.tppwholesale.com.au" ] }, "evidence_basis": "provider_documented_pattern" }, { "id": "tpp-wholesale-relay-spf", "provider_id": "tpp-wholesale", "service": "TPP Wholesale mail relay SPF", "role": "spf_reference", "match_type": "exact", "patterns": [ "relay.tppwholesale.com.au" ], "status": "active", "source": { "url": "https://support.tppwholesale.com.au/hc/en-gb/articles/32254759124509-SPF-Record-Configuration-Required-for-Email-Deliverability", "title": "SPF Record Configuration Required for Email Deliverability | TPP Wholesale", "basis": "TPP Wholesale explicitly requires include:relay.tppwholesale.com.au for email delivered through its system. The proposal is exact and keeps this sender-service evidence separate from existing TPP Wholesale DNS-hosting evidence.", "reviewed_on": "2026-09-09", "review_due": "2027-03-09" }, "fixtures": { "positive": [ "relay.tppwholesale.com.au", "RELAY.TPPWHOLESALE.COM.AU." ], "negative": [ "tppwholesale.com.au", "mail.tppwholesale.com.au", "x.relay.tppwholesale.com.au", "relay.tppwholesale.com.au.example.org", "sent-via.netsuite.com", "4501nxl41s.powerspf.com" ] }, "evidence_basis": "provider_documented_pattern" }, { "id": "alchemer-email-sending-spf", "provider_id": "alchemer", "service": "Email sending SPF (legacy SurveyGizmo namespace)", "role": "spf_reference", "match_type": "exact", "patterns": [ "app.sgizmo.com" ], "status": "active", "source": { "url": "https://help.alchemer.com/help/pdfexport/id/5f2ed398ed121cdc1484531e", "title": "Alchemer email/SPF guidance (legacy SurveyGizmo namespace)", "basis": "Alchemer first-party legacy SurveyGizmo guidance shows v=spf1 include:app.sgizmo.com ~all and notes account/data-centre variation, establishing this exact observed customer-facing SPF namespace without justifying broader matching.", "reviewed_on": "2026-10-07", "review_due": "2027-04-07" }, "fixtures": { "positive": [ "app.sgizmo.com" ], "negative": [ "invalid.app.sgizmo.com" ] }, "evidence_basis": "provider_documented_pattern" }, { "id": "check-point-harmony-outbound-spf", "provider_id": "check-point", "service": "Harmony Email & Collaboration outbound SPF", "role": "spf_reference", "match_type": "exact", "patterns": [ "spfa.cpmails.com" ], "status": "active", "source": { "url": "https://sc1.checkpoint.com/documents/Harmony_Email_and_Collaboration/Email_Security/Admin_Guide/Topics/threat-detection-policy-for-outgoing-emails/prerequisites-to-avoid-failing-spf-checks.html", "title": "Prerequisites to avoid failing SPF checks", "basis": "Check Point first-party Harmony Email & Collaboration guidance explicitly requires include:spfa.cpmails.com when its Email Security service is in the outgoing mail path, establishing the provider, outbound service role and exact SPF reference.", "reviewed_on": "2026-10-07", "review_due": "2027-04-07" }, "fixtures": { "positive": [ "spfa.cpmails.com" ], "negative": [ "invalid.spfa.cpmails.com" ] }, "evidence_basis": "provider_documented_pattern" }, { "id": "clicksend-email-sending-spf", "provider_id": "clicksend", "service": "Email sending SPF", "role": "spf_reference", "match_type": "exact", "patterns": [ "online-send.com", "click-send.net" ], "status": "active", "source": { "url": "https://clicksend.helpdocs.io/article/hxzoxblz68-clicksend-spf-record", "title": "ClickSend SPF records", "basis": "ClickSend first-party documentation explicitly instructs customers to include both online-send.com and click-send.net in their SPF configuration. This establishes the provider, email-sending SPF role and both exact customer-facing references as one bounded service relationship.", "reviewed_on": "2026-10-07", "review_due": "2027-04-07" }, "fixtures": { "positive": [ "online-send.com", "click-send.net" ], "negative": [ "invalid.online-send.com", "invalid.click-send.net" ] }, "evidence_basis": "provider_documented_pattern" }, { "id": "codetwo-emailsignatures365-au-spf", "provider_id": "codetwo", "service": "Email Signatures 365 SPF (Australia East)", "role": "spf_reference", "match_type": "exact", "patterns": [ "spf-au.emailsignatures365.com" ], "status": "active", "source": { "url": "https://www.codetwo.com/userguide/email-signatures-for-office-365/spf-records.htm", "title": "Configuring the SPF TXT record of a domain", "basis": "CodeTwo first-party documentation explicitly identifies spf-au.emailsignatures365.com as the SPF reference for Email Signatures 365 customers in the Australia East region. This establishes the provider, service context, SPF-reference role and exact customer-facing namespace.", "reviewed_on": "2026-10-07", "review_due": "2027-04-07" }, "fixtures": { "positive": [ "spf-au.emailsignatures365.com" ], "negative": [ "invalid.spf-au.emailsignatures365.com" ] }, "evidence_basis": "provider_documented_pattern" }, { "id": "easydmarc-easyspf", "provider_id": "easydmarc", "service": "EasySPF", "role": "spf_reference", "match_type": "exact", "patterns": [ "_spf.lifeline_org_au._d.easydmarc.pro" ], "status": "active", "source": { "url": "https://support.easydmarc.com/knowledge-base/faq", "title": "EasyDMARC FAQ", "basis": "EasyDMARC first-party material documents EasySPF-managed SPF records using the customer-labelled _spf.._d.easydmarc.pro namespace.", "reviewed_on": "2026-10-07", "review_due": "2027-04-07" }, "fixtures": { "positive": [ "_spf.lifeline_org_au._d.easydmarc.pro" ], "negative": [ "invalid._spf.lifeline_org_au._d.easydmarc.pro" ] }, "evidence_basis": "provider_documented_pattern" }, { "id": "elastic-email-sender-spf", "provider_id": "elastic-email", "service": "Email sending SPF", "role": "spf_reference", "match_type": "exact", "patterns": [ "_spf.elasticemail.com" ], "status": "active", "source": { "url": "https://help.elasticemail.com/en/articles/4934400-how-to-verify-your-domain", "title": "How to verify your domain", "basis": "Elastic Email first-party domain-verification documentation explicitly instructs customers to add include:_spf.elasticemail.com to SPF. This establishes the provider, email-sending SPF role and exact customer-facing namespace.", "reviewed_on": "2026-10-07", "review_due": "2027-04-07" }, "fixtures": { "positive": [ "_spf.elasticemail.com" ], "negative": [ "invalid._spf.elasticemail.com" ] }, "evidence_basis": "provider_documented_pattern" }, { "id": "mailerlite-email-sending-spf", "provider_id": "mailerlite", "service": "Email sending SPF", "role": "spf_reference", "match_type": "exact", "patterns": [ "_spf.mlsend.com" ], "status": "active", "source": { "url": "https://www.mailerlite.com/help/how-to-merge-spf-records", "title": "How to merge SPF records", "basis": "MailerLite first-party documentation explicitly uses include:_spf.mlsend.com when instructing customers how to merge SPF records, establishing the provider, email-sending SPF role and exact customer-facing namespace.", "reviewed_on": "2026-10-07", "review_due": "2027-04-07" }, "fixtures": { "positive": [ "_spf.mlsend.com" ], "negative": [ "invalid._spf.mlsend.com" ] }, "evidence_basis": "provider_documented_pattern" }, { "id": "micron21-spf", "provider_id": "micron21", "service": "Hosted/outbound mail SPF", "role": "spf_reference", "match_type": "exact", "patterns": [ "spf.micron21.com" ], "status": "active", "source": { "url": "https://support.micron21.com/kb/articles/adding-a-spf-record-to-your-dns-zone-for-micron21-cpanel-mail-with-external-dns-hosting", "title": "Adding a SPF record to your DNS zone for Micron21 cPanel mail with external DNS hosting", "basis": "Micron21 first-party guidance for cPanel mail with externally hosted DNS instructs customers to add include:spf.micron21.com to an existing SPF record, or publish v=spf1 include:spf.micron21.com +a +mx ~all, establishing this exact SPF reference for Micron21 cPanel outbound mail without justifying broader namespace matching.", "reviewed_on": "2026-10-07", "review_due": "2027-04-07" }, "fixtures": { "positive": [ "spf.micron21.com" ], "negative": [ "invalid.spf.micron21.com" ] }, "evidence_basis": "provider_documented_pattern" }, { "id": "ortto-autopilot-email-sending-spf", "provider_id": "ortto", "service": "Autopilot email sending SPF", "role": "spf_reference", "match_type": "exact", "patterns": [ "spf.autopilothq.com" ], "status": "active", "source": { "url": "https://help.ortto.com/a-368-autopilot-configure-your-custom-email-domain", "title": "Autopilot: configure your custom email domain", "basis": "Ortto first-party Autopilot guidance explicitly uses include:spf.autopilothq.com, establishing the provider, service role and exact customer-facing SPF reference.", "reviewed_on": "2026-10-07", "review_due": "2027-04-07" }, "fixtures": { "positive": [ "spf.autopilothq.com" ], "negative": [ "invalid.spf.autopilothq.com" ] }, "evidence_basis": "provider_documented_pattern" }, { "id": "raisely-email-sending-spf", "provider_id": "raisely", "service": "Email sending SPF", "role": "spf_reference", "match_type": "exact", "patterns": [ "raiselysite.com" ], "status": "active", "source": { "url": "https://support.raisely.com/hc/en-us/articles/44649207990541-Org-Settings-Email-Sending-Domain", "title": "Org Settings: Email Sending Domain", "basis": "Raisely first-party documentation explicitly provides include:raiselysite.com for customer email-sending domains, establishing the provider, role and exact SPF reference.", "reviewed_on": "2026-10-07", "review_due": "2027-04-07" }, "fixtures": { "positive": [ "raiselysite.com" ], "negative": [ "invalid.raiselysite.com" ] }, "evidence_basis": "provider_documented_pattern" }, { "id": "sendmarc-spf-delegation", "provider_id": "sendmarc", "service": "SPF Delegation", "role": "spf_reference", "match_type": "exact", "patterns": [ "_sjc5xsqq8.sdmarc.net" ], "status": "active", "source": { "url": "https://help.sendmarc.com/dns-record-delegation", "title": "DNS record delegation", "basis": "Sendmarc first-party documentation describes delegated customer DNS/SPF records using unique identifiers under sdmarc.net, establishing the managed SPF delegation service and namespace form.", "reviewed_on": "2026-10-07", "review_due": "2027-04-07" }, "fixtures": { "positive": [ "_sjc5xsqq8.sdmarc.net" ], "negative": [ "invalid._sjc5xsqq8.sdmarc.net" ] }, "evidence_basis": "provider_documented_pattern" }, { "id": "ventraip-hostingplatform-spf", "provider_id": "ventraip", "service": "Select/cPanel Hosting SPF", "role": "spf_reference", "match_type": "exact", "patterns": [ "spf.hostingplatform.net.au" ], "status": "active", "source": { "url": "https://ventraip.com.au/support-centre/what-to-do-if-your-spf-record-is-invalid-or-missing/", "title": "What To Do if Your SPF Record Is Invalid or Missing", "basis": "VentraIP explicitly identifies Select Hosting (cPanel) and instructs customers to use an SPF record containing include:spf.hostingplatform.net.au. This establishes the provider, SPF-reference role and exact customer-facing namespace.", "reviewed_on": "2026-10-07", "review_due": "2027-04-07" }, "fixtures": { "positive": [ "spf.hostingplatform.net.au" ], "negative": [ "invalid.spf.hostingplatform.net.au" ] }, "evidence_basis": "provider_documented_pattern" }, { "id": "csc-managed-authoritative-dns", "provider_id": "csc", "service": "Managed DNS", "role": "dns_hosting", "match_type": "exact", "patterns": [ "udns1.cscdns.net", "udns2.cscdns.uk", "dns1.cscdns.net", "dns2.cscdns.net" ], "status": "active", "evidence_basis": "provider_operational_instruction", "source": { "url": "https://www.cscdbs.com/en/solutions/dns-services-ddos/", "title": "CSC Managed DNS / DNS Services & DDoS", "basis": "CSC publicly establishes its Managed DNS service and its Vercara/UltraDNS delivery. Combined with retained direct CSC Support instruction, this corroborates the provider/service relationship for the exact cscdns endpoints without asserting ownership of the underlying network.", "reviewed_on": "2026-10-09", "review_due": "2027-04-09" }, "fixtures": { "positive": [ "udns1.cscdns.net", "udns2.cscdns.uk", "dns1.cscdns.net", "dns2.cscdns.net" ], "negative": [ "invalid.udns1.cscdns.net", "invalid.udns2.cscdns.uk", "invalid.dns1.cscdns.net", "invalid.dns2.cscdns.net" ] } } ] }