posteo.net email servers, SPF and DMARC

posteo.net publishes 3 MX hosts, all at priority 10, so senders spread mail across them.

2 other domains we checked on the same day also route mail to hosts under posteo.de, with different records from posteo.net: posteo.at and posteo.ch.

The record on 5 November 2026 was v=spf1 redirect=posteo.de.

In plain terms, it delegates to posteo.de. The top level uses 1 DNS-querying term; SPF allows 10 in total including nested includes (RFC 7208 §4.6.4).

The record is v=DMARC1; p=none; sp=reject; adkim=s; aspf=s.

p=none only asks for reports; failing mail is delivered as normal. Subdomains get sp=reject.

_mta-sts.posteo.net publishes v=STSv1; id=20251202110430Z, so posteo.net uses MTA-STS: sending servers that support it must deliver over verified TLS or not at all (RFC 8461).

1 other domain published exactly the same MX hosts and SPF record as posteo.net on 5 November 2026: posteo.eu. Mail to any of them lands on the same servers.

posteo.net shares mx01.posteo.de and mx03.posteo.de with posteo.de. When we tested those servers for posteo.de on 13 October 2026, the result was: Verifiable. The server rejects unknown recipients during the SMTP conversation.

Our checker treats @posteo.net like any domain: syntax, MX, disposable and role checks first, then a made-up address to rule out a catch-all, then your address at RCPT TO, disconnecting without sending. We have not tested @posteo.net itself, but its mail goes to the same servers as posteo.de, so expect @posteo.net results to follow the pattern described there. Each result carries its own reason.

DNS tells you where mail goes, not whether one person's mailbox still exists. For a list, run the whole file through a verifier before you send: invalid rows come out, risky rows (catch-all, unknown, refused) go in their own segment, and valid rows are safe to mail.