Mail trust posture

Current MX, SPF and DMARC posture, plus visible mail-service associations across the fixed .auDO panel.

Current panel view Observation 10 Sep 2026 100 domain fixed panel

Mail trust aggregate published for 10 Sep 2026.

Current observations

What is visible now

Current MX, SPF and DMARC findings. Evidence and full distributions follow below.

MX

92 domains with public MX visible

0 Null MX · 4 not observed · 4 indeterminate

SPF

98 domains with SPF material observed

84 single · 0 multiple · 14 malformed · 2 indeterminate

DMARC

97 domains with DMARC material observed

97 valid · 0 multiple · 0 malformed · 2 indeterminate

These are current panel observations. Detailed posture and evidence follow below.

Visible infrastructure links

Mail service associations

Provider Resolution matches visible MX targets and first-order SPF include: / redirect= references to documented providers. It does not change Mail Posture.

Inbound routing and SPF service references are shown separately because they describe different roles. Provider associations come first; evidence and coverage sit behind each card.

These are infrastructure associations, not supplier contracts or market share. An unresolved reference means no documented catalogue match was found.

Observed 2026-09-10 across the 100-domain fixed panel · Provider Catalogue 1.5.0

Inbound mail routing

Documented providers linked from visible MX routing targets.

83of 92 target-bearing domains had at least one documented association.

Documented providers seen across 5+ target-bearing domains

  • Google11 of 92 target-bearing domains
  • Microsoft41 of 92 target-bearing domains
  • Mimecast11 of 92 target-bearing domains
  • Proofpoint16 of 92 target-bearing domains

Provider counts can overlap because one domain may show several associations. They are not market share.

Evidence and coverage
96usable evidence
92target-bearing domains
83domains with a documented association
11domains with unresolved targets
  • 4 panel domains had insufficient evidence for this role.
  • 4 usable domains had no first-order target for this role.
  • 159 of 194 visible targets matched documented Provider Catalogue associations; 35 remained unresolved.
  • 6 documented providers were visible; 0 target-bearing domains showed more than one.

SPF service references

Documented providers linked from first-order SPF include and redirect targets.

65of 83 target-bearing domains had at least one documented association.

Documented providers seen across 5+ target-bearing domains

  • Amazon Web Services13 of 83 target-bearing domains
  • Campaign Monitor6 of 83 target-bearing domains
  • Google8 of 83 target-bearing domains
  • Mailchimp11 of 83 target-bearing domains
  • Mailgun6 of 83 target-bearing domains
  • Microsoft44 of 83 target-bearing domains
  • Mimecast8 of 83 target-bearing domains
  • Salesforce18 of 83 target-bearing domains
  • SAP5 of 83 target-bearing domains
  • Twilio SendGrid5 of 83 target-bearing domains

Provider counts can overlap because one domain may show several associations. They are not market share.

Evidence and coverage
98usable evidence
83target-bearing domains
65domains with a documented association
56domains with unresolved targets
  • 2 panel domains had insufficient evidence for this role.
  • 15 usable domains had no first-order target for this role.
  • 160 of 275 visible targets matched documented Provider Catalogue associations; 115 remained unresolved.
  • 29 documented providers were visible; 43 target-bearing domains showed more than one.

These are visible infrastructure associations. They do not prove supplier contracts, ownership, service quality or a complete sender inventory. Unresolved means no documented catalogue match was found.

Evidence coverage

Evidence behind the current posture

Shows which observations could be classified and which were indeterminate.

MX

Whether a public mail route was visible.

Panel100

96Determinate
4Indeterminate
Status
Published
Posture denominator
96
  • Visible9295.8%
  • Null MX00%
  • Not observed44.2%

SPF

What SPF record shape was observed.

Panel100

98Determinate
2Indeterminate
Status
Published
Posture denominator
98
  • Not observed00%
  • Single SPF record8485.7%
  • Multiple records00%
  • Malformed1414.3%

DMARC

What DMARC record state was observed.

Panel100

98Determinate
2Indeterminate
Status
Published
Posture denominator
98
  • Not observed11%
  • Valid9799%
  • Multiple records00%
  • Malformed00%

Detailed evidence

Full Mail trust distributions

Full MX, SPF and DMARC distributions, including secondary SPF and DMARC detail.

MX posture

Status
Published
Denominator
96
  • Visible9295.8%
  • Null MX00%
  • Not observed44.2%

SPF posture

Status
Published
Denominator
98
  • Not observed00%
  • Single SPF record8485.7%
  • Multiple records00%
  • Malformed1414.3%

SPF terminal qualifier

Status
Published
Denominator
84
  • Fail (-all)4148.8%
  • Soft fail (~all)3440.5%
  • Neutral (?all)44.8%
  • Pass (+all)00%
  • Terminal all missing56%

DMARC posture

Status
Published
Denominator
98
  • Not observed11%
  • Valid9799%
  • Multiple records00%
  • Malformed00%

DMARC policy (p)

Status
Published
Denominator
97
  • None1616.5%
  • Quarantine1313.4%
  • Reject6870.1%

DMARC subdomain policy (sp)

Status
Published
Denominator
97
  • None99.3%
  • Quarantine44.1%
  • Reject1818.6%
  • Inherited6668%

DMARC SPF alignment mode (aspf)

Status
Published
Denominator
97
  • Relaxed9294.9%
  • Strict55.2%

DMARC DKIM alignment mode (adkim)

Status
Published
Denominator
97
  • Relaxed9294.9%
  • Strict55.2%

Cohort views

Mail trust by cohort

Eligible cohorts show the same Mail posture and service-association view. Small cells remain suppressed, and cohorts may overlap.

A domain may appear in more than one analytical cohort. Cohort membership totals therefore do not sum to the fixed panel size.

Australian government14 domainsView MX, SPF and DMARC posture

MX

14 determinate · 0 indeterminate

Status
Published
Posture denominator
14
  • VisibleSuppressedComplementary suppression
  • Null MX00%
  • Not observedSuppressedSmall-cell suppression

SPF

14 determinate · 0 indeterminate

Status
Published
Posture denominator
14
  • Not observed00%
  • Single SPF record14100%
  • Multiple records00%
  • Malformed00%

DMARC

14 determinate · 0 indeterminate

Status
Published
Posture denominator
14
  • Not observed00%
  • Valid14100%
  • Multiple records00%
  • Malformed00%
View cohort context
Australian not-for-profit16 domainsView MX, SPF and DMARC posture

MX

15 determinate · 1 indeterminate

Status
Published
Posture denominator
15
  • Visible15100%
  • Null MX00%
  • Not observed00%

SPF

15 determinate · 1 indeterminate

Status
Published
Posture denominator
15
  • Not observed00%
  • Single SPF recordSuppressedComplementary suppression
  • Multiple records00%
  • MalformedSuppressedSmall-cell suppression

DMARC

15 determinate · 1 indeterminate

Status
Published
Posture denominator
15
  • Not observed00%
  • Valid15100%
  • Multiple records00%
  • Malformed00%
View cohort context
Australian higher education10 domainsView MX, SPF and DMARC posture

MX

10 determinate · 0 indeterminate

Status
Published
Posture denominator
10
  • Visible10100%
  • Null MX00%
  • Not observed00%

SPF

10 determinate · 0 indeterminate

Status
Published
Posture denominator
10
  • Not observed00%
  • Single SPF recordSuppressedComplementary suppression
  • Multiple records00%
  • MalformedSuppressedSmall-cell suppression

DMARC

10 determinate · 0 indeterminate

Status
Published
Posture denominator
10
  • Not observed00%
  • Valid10100%
  • Multiple records00%
  • Malformed00%
View cohort context
Retail and marketplaces14 domainsView MX, SPF and DMARC posture

MX

14 determinate · 0 indeterminate

Status
Published
Posture denominator
14
  • Visible14100%
  • Null MX00%
  • Not observed00%

SPF

14 determinate · 0 indeterminate

Status
Published
Posture denominator
14
  • Not observed00%
  • Single SPF recordSuppressedComplementary suppression
  • Multiple records00%
  • MalformedSuppressedSmall-cell suppression

DMARC

14 determinate · 0 indeterminate

Status
Published
Posture denominator
14
  • Not observed00%
  • Valid14100%
  • Multiple records00%
  • Malformed00%
View cohort context
Public interest21 domains · overlapping cohort lensView MX, SPF and DMARC posture

MX

21 determinate · 0 indeterminate

Status
Published
Posture denominator
21
  • VisibleSuppressedComplementary suppression
  • Null MX00%
  • Not observedSuppressedSmall-cell suppression

SPF

21 determinate · 0 indeterminate

Status
Published
Posture denominator
21
  • Not observed00%
  • Single SPF record1885.7%
  • Multiple records00%
  • Malformed314.3%

DMARC

21 determinate · 0 indeterminate

Status
Published
Posture denominator
21
  • Not observed00%
  • Valid21100%
  • Multiple records00%
  • Malformed00%
View cohort context

Method and privacy

How this view is derived

Mail trust combines MX, SPF and DMARC observations. Provider Resolution separately matches selected MX and SPF targets to documented providers.

The browser renders published aggregates. It does not derive Mail posture from raw DNS records, parse SPF policy, run Provider Resolution or reconstruct suppressed values.

Posture aggregate

mail-posture-aggregate/v1 defines the public Mail Posture aggregate and suppression rules.

Source derivation

mail-posture/v1 derives per-domain MX, SPF and DMARC posture from classified evidence.

Suppression

Suppressed cohort cells stay hidden. A hidden count or share is never shown as zero.

Publication privacy metadata

  • Minimum cohort denominator: 10
  • Small-cell threshold: 3
  • Panel cell suppression: Not Applied
  • Cohort suppression: Primary And Complementary

Limits

Published limitations

  • Counts describe the fixed observed .auDO panel, not the whole .au namespace.
  • Cohorts are curated analytical lenses and may overlap; they are not whole-sector assessments.
  • Mail Posture v1 describes visible public MX, SPF and DMARC evidence at the observation date.
  • Indeterminate evidence reflects insufficient observation evidence and must not be interpreted as absence.
  • SPF derivation is intentionally bounded and does not recursively resolve include or redirect chains.
  • DMARC policy and tag values describe the visible record and are not a rating of organisational mail-security maturity.
  • The aggregate does not establish compliance, security effectiveness, compromise, incident status, organisational intent or risk.
  • Small cohort cells may be suppressed to limit inadvertent disclosure of individual posture from aggregate data.

More context

MX records SPF DMARC Mail service associations DMARC observed presence Methodology Observation Guide