fastmail.de email servers, SPF and DMARC

fastmail.de publishes 2 MX hosts; senders try the lowest priority number first (eu1-smtp.messagingengine.com, 10) and fall back to the others in order.

2 other domains we checked on the same day also route mail to hosts under messagingengine.com, with different records from fastmail.de: fastmail.fm and fastmail.us.

The record on 5 November 2026 was v=spf1 include:spf.messagingengine.com ~all.

In plain terms, it delegates to spf.messagingengine.com. The top level uses 1 DNS-querying term; SPF allows 10 in total including nested includes (RFC 7208 §4.6.4).

It ends in a soft fail (~all): mail from unlisted servers should be accepted but treated as suspicious.

The record is v=DMARC1; p=none; rua=mailto:[email protected].

p=none only asks for reports; failing mail is delivered as normal.

Aggregate reports go to inbox.ondmarc.com, so the domain's owner sees who sends mail as @fastmail.de.

_mta-sts.fastmail.de publishes v=STSv1; id=20260728T132000, so fastmail.de uses MTA-STS: sending servers that support it must deliver over verified TLS or not at all (RFC 8461).

It also asks for TLS reports with v=TLSRPTv1; rua=mailto:[email protected] (RFC 8460).

Our checker treats @fastmail.de like any domain: syntax, MX, disposable and role checks first, then a made-up address to rule out a catch-all, then your address at RCPT TO, disconnecting without sending. We have not published a test of how eu1-smtp.messagingengine.com answers for @fastmail.de, so we make no claim here about whether single mailboxes can be confirmed; each result carries its own reason.

DNS tells you where mail goes, not whether one person's mailbox still exists. For a list, run the whole file through a verifier before you send: invalid rows come out, risky rows (catch-all, unknown, refused) go in their own segment, and valid rows are safe to mail.