Email DNS fingerprints: pphosted is Proofpoint, and 70 other strings decoded
Mail infrastructure announces itself. A gateway hostname names the security vendor, an SPF include names the marketing platform, a DKIM selector names the mail host, and a DMARC reporting address names the consultancy watching the reports. Paste any of them here and get the vendor, its role in the mail path, and what its presence actually tells you.
- MX hosts
- SPF includes
- DKIM selectors
- DMARC rua
- PTR names
Fingerprint identifier
The identifier needs JavaScript. Enable it to paste a string, or read the reference tables below, which contain the same data.
Quick answer
How to identify a mail provider from DNS
Read the MX hostnames first. They name either the mailbox provider (Google Workspace, Microsoft 365, Zoho) or a security gateway placed in front of it (Proofpoint, Mimecast, Barracuda, Cisco). When a gateway answers on the MX, the mailbox provider is hidden from DNS, and the SPF includes and DKIM selectors are where you find it.
- pphosted.com is Proofpoint. ppe-hosted.com is Proofpoint Essentials, the mid-market product, usually sold by a managed service provider.
- iphmx.com is Cisco Secure Email, formerly IronPort. mailcontrol.com is Forcepoint. messagelabs.com is Broadcom, formerly Symantec.
- Region prefixes and suffixes leak data residency. eu-smtp-inbound-1.mimecast.com, mx.zoho.eu and inbound-smtp.ca-central-1.amazonaws.com each state where the mail lands.
- SPF enumerates vendors. Every include authorises a third party, so the record lists the CRM, the marketing tool, the helpdesk, and often the phishing-simulation platform.
- A match is evidence, not proof of use. Stale includes and abandoned selectors are common. The record shows a relationship existed, not that it still does.
MX, part one
Security gateways: the hostnames that hide the real provider
These vendors answer on the MX and forward clean mail onward. If you see one of them, you have learned the security product but not yet the mailbox platform.
| String | Vendor | What it tells you |
|---|---|---|
pphosted.com | Proofpoint Email Protection | Enterprise security spend, usually with a security team. Example: mx0a-00191401.pphosted.com. |
ppe-hosted.com | Proofpoint Essentials | The mid-market tier. Frequently deployed by a managed service provider rather than an in-house team. |
mimecast.com | Mimecast | The region prefix names the grid: eu-, us-, uk-, za-, au-, de-, ca-, jp-. Customers are usually Microsoft 365 underneath. |
iphmx.com | Cisco Secure Email (IronPort) | The hc####-## token is the customer's cluster. Often part of a wider Cisco estate. |
barracudanetworks.com, ess.barracuda | Barracuda Email Security | Strong in mid-market and education. Commonly reseller-installed. |
mailcontrol.com | Forcepoint Email Security | Over-represented in government and regulated sectors. |
messagelabs.com | Broadcom Email Security.cloud | The former Symantec MessageLabs. A long-standing contract that has not been re-tendered recently. |
hes.trendmicro.com | Trend Micro Hosted Email Security | Usually bundled with Trend Micro endpoint protection. |
sophos.com | Sophos Email | Smaller organisation, typically already running Sophos endpoint. |
antispamcloud.com | SpamExperts (N-able) | White-labelled filtering bundled by a hosting provider, not a chosen security product. |
MX, part two
Mailbox providers, forwarders, and the domain that takes no mail
| String | Vendor | What it tells you |
|---|---|---|
aspmx.l.google.com, smtp.google.com | Google Workspace | Five ASPMX hosts is an older tenant; a single smtp.google.com is a newer one. |
<tenant>.mail.protection.outlook.com | Microsoft 365 | The label is the tenant name. It often reveals the legal entity and survives rebrands. |
mx.zoho.com, .eu, .in | Zoho Mail | The suffix is the data region. |
protonmail.ch | Proton Mail | Custom domains are a paid plan, so this indicates a deliberate privacy posture. |
messagingengine.com | Fastmail | Rarely a default choice, so usually a technically literate owner. |
inbound-smtp.<region>.amazonaws.com | Amazon SES or WorkMail | The region says where mail lands. Inbound SES with no webmail often means an application endpoint, not a person. |
emailsrvr.com | Rackspace Email | A long-established small business domain. DMARC is often absent. |
registrar-servers.com | Namecheap Private Email | The domain is registered at Namecheap and mail was an upsell. |
secureserver.net | GoDaddy | The older GoDaddy platform. GoDaddy also resells Microsoft 365, which points at outlook.com instead. |
titan.email | Titan | Sold through registrars and site builders. Small business. |
yandex.net, mxbiz1.qq.com, mxhichina.com | Yandex 360, Tencent Exmail, Alibaba Mail | Jurisdiction signals worth noting before you send anything sensitive. |
hostedemail.com | Open-Xchange, white-labelled | Names no reseller. The domain's nameservers usually identify who sold it. |
improvmx.com, forwardemail.net, mx.cloudflare.net | Forwarding services | There is no mailbox here. Mail is relayed elsewhere and outbound comes from a different platform entirely. |
0 . (a single dot) | RFC 7505 null MX | The domain declares it accepts no mail. A deliberate, well-informed configuration. |
SPF includes
The record that enumerates a company's software
An SPF include authorises a third party to send as the domain, which means the record is a public list of vendor relationships. This is inherent to how SPF works and cannot be avoided without breaking mail.
| Include | Vendor | Category and read |
|---|---|---|
_spf.google.com | Google Workspace | Mail platform. Costs three of the ten permitted lookups on its own. |
spf.protection.outlook.com | Microsoft 365 | Mail platform. Costs two lookups. |
sendgrid.net, mailgun.org, amazonses.com | SendGrid, Mailgun, Amazon SES | Transactional sending, so there is an application behind the domain. |
servers.mcsv.net, spf.mandrillapp.com | Mailchimp, Mandrill | Marketing owns part of the sending. A frequent source of DMARC alignment failures. |
_spf.hubspot.com | HubSpot | Mid-market go-to-market stack. |
_spf.salesforce.com, et._spf.pardot.com, mktomail.com | Salesforce, Pardot, Marketo | Enterprise CRM and marketing automation, usually with a sales team attached. |
_spf.klaviyo.com, shops.shopify.com | Klaviyo, Shopify | Direct-to-consumer ecommerce. |
mail.zendesk.com, _spf.freshemail.io | Zendesk, Freshworks | A customer support function. |
_spf.psm.knowbe4.com | KnowBe4 | Phishing simulation. Confirms a security-awareness programme and names its vendor. One of the most informative includes there is. |
_spf.workday.com, mail.greenhouse.io | Workday, Greenhouse | HR and recruiting. Workday implies significant headcount. |
_spf.netsuite.com, *.sap.com | NetSuite, SAP | The finance system, which is a relevant signal for invoice-fraud exposure. |
mail.docusign.net, _spf.stripe.com | DocuSign, Stripe | Contract and payment workflows. |
_spf.atlassian.net, *.service-now.com | Atlassian, ServiceNow | Engineering tooling and formal IT process. |
DKIM selectors and DMARC addresses
Two more places vendors sign their name
| String | Vendor | What it tells you |
|---|---|---|
google._domainkey | Google Workspace | Google defaults to 1024-bit. A 1024-bit key here means the default was never changed. |
selector1, selector2 | Microsoft 365 | Two selectors is normal. Microsoft rotates between them automatically. |
s1, s2 | SendGrid | Published as CNAMEs. Confirms application mail. |
k1, k2 | Mailchimp | Present without a configured authentication domain means campaigns fail alignment. |
mte1, mte2 | Mimecast | Mimecast is signing outbound too, not just filtering inbound. |
pm, scph#####, hs1-##### | Postmark, SparkPost, HubSpot | The HubSpot selector embeds the portal id. |
default, mail, dkim | Self-managed | The conventions of Postfix with OpenDKIM, Mailcow and Mail-in-a-Box. Suggests an owned server: check its PTR and ASN. |
[email protected], valimail.com, agari.com | dmarcian, Valimail, Agari | A managed DMARC programme. Someone is paid to read the reports. |
[email protected] | Postmark free digest | Better than nothing, and it usually means nobody is doing daily analysis. |
[email protected] | Cloudflare DMARC Management | The domain is on Cloudflare and someone enabled it from the dashboard. |
ec2-*.compute.amazonaws.com, *.bc.googleusercontent.com | Cloud provider defaults | A generic PTR on a sending host is a spam signal and a sign the server was stood up quickly. |
PTR containing dynamic, dsl, pool | Consumer access range | Rejected by most receivers as policy, regardless of authentication. |
Worked examples
Reading a whole stack from four records
Individual strings are facts. The combination is where the reading happens.
A filtered enterprise
ExampleMX mx0a-00191401.pphosted.com SPF v=spf1 include:spf.protection.outlook.com include:_spf.psm.knowbe4.com -all DKIM selector1._domainkey, mte1._domainkey DMARC v=DMARC1; p=reject; rua=mailto:[email protected]
Proofpoint filters inbound, Microsoft 365 stores the mail, KnowBe4 runs phishing simulations, and Agari processes DMARC reports at a reject policy. The mte1 selector is the odd one: Mimecast signing alongside a Proofpoint MX usually means a migration between gateways that was never finished.
A small business on autopilot
ExampleMX mx1.registrar-servers.com SPF v=spf1 include:spf.registrar-servers.com ~all DKIM (nothing at common selectors) DMARC (no record)
Mail came with the domain registration. No DKIM, no DMARC, and nobody watching. Anyone can send as this domain and the owner will never see a report. This is the most common configuration on the internet.
A product company
ExampleMX aspmx.l.google.com SPF v=spf1 include:_spf.google.com include:sendgrid.net include:_spf.intercom.io ~all DKIM google._domainkey, s1._domainkey DMARC v=DMARC1; p=none; rua=mailto:[email protected]
Google Workspace for staff, SendGrid for application mail, Intercom for lifecycle messaging. The free Postmark digest and p=none say authentication was set up by an engineer once and has not been revisited. Moving to quarantine is the obvious next step.
A domain that should send nothing
Recommended for parked domainsMX 0 . SPF v=spf1 -all DMARC v=DMARC1; p=reject; sp=reject; rua=mailto:[email protected]; fo=1
A null MX plus an empty SPF plus a reject policy. This is the correct configuration for brand-defensive registrations, old domains and web-only hostnames, and it is very often missing. Attackers prefer these domains precisely because nobody is watching them.
Sources & limits
What this reference can and cannot tell you
Every pattern is compiled from the named vendor's own published setup documentation, which is where these hostnames are defined. The identifier runs entirely in your browser with no network request, matching against that list, which is why it works on a string copied out of a message header rather than looked up live.
Three limits are worth stating plainly. A match shows a DNS record exists, not that the service is in use: stale includes and abandoned selectors are extremely common, and a record may name a platform the organisation stopped paying for years ago. A non-match means nothing much, because self-hosted mail and white-labelled reseller platforms produce hostnames that identify nobody. And none of this is a security assessment: it describes what a domain publishes, which is public by design. For the operational side of the same data, the MX checker, SPF checker, DKIM checker and DMARC checker query it live and rate what they find.
FAQ
Fingerprint questions, answered
What does pphosted.com mean in an MX record?
pphosted.com is Proofpoint. A hostname such as mx0a-00191401.pphosted.com means Proofpoint Email Protection is filtering inbound mail for the domain, sitting in front of whichever mailbox provider actually stores it. The related domain ppe-hosted.com is Proofpoint Essentials, the mid-market product usually sold through a managed service provider. Because the gateway answers on the MX, the mailbox provider behind it is hidden from DNS: the SPF record and DKIM selectors are where you find it.
What does iphmx.com mean?
iphmx.com is Cisco Secure Email, the hosted service formerly sold as IronPort. A hostname like esa.hc1234-56.iphmx.com identifies the customer's allocated cluster in the hc token. Like any gateway, it filters inbound mail in front of the real mailbox provider.
How do I tell which email provider a domain uses?
Read the MX hostnames first. aspmx.l.google.com or smtp.google.com is Google Workspace; anything ending in mail.protection.outlook.com is Microsoft 365, with the tenant name in the label; mx.zoho.com is Zoho. If the MX names a security gateway such as Proofpoint, Mimecast, Barracuda or Cisco, the mailbox provider is concealed, and the SPF includes and DKIM selectors will identify it instead. A hostname matching no known vendor usually means self-hosted mail or a white-labelled reseller platform.
Can I identify a company's software stack from its email DNS?
Partly, and it is a well-known consequence of publishing SPF. Every include authorises a third party to send as the domain, so the record enumerates vendors: a CRM, a marketing platform, a support desk, an ERP, an applicant tracking system, and in many cases a phishing-simulation vendor, which also confirms a security-awareness programme exists. The information is public by design and cannot be withheld without breaking mail, though SPF flattening replaces named includes with bare IP ranges and incidentally reveals less.
Does a matching fingerprint prove anything?
It proves the DNS record exists and names that vendor. It does not prove the service is in active use. Stale includes and abandoned selectors are extremely common, so treat a fingerprint as evidence of a relationship at some point in time, then corroborate it with mail you have actually received from the domain.
Is this tool sending my input anywhere?
No. Matching runs entirely inside the page against a list of published vendor patterns, with no network request of any kind. That is why it works on strings you cannot look up in DNS, such as a hostname copied from a Received header.
Now check the domain live.
The reference tells you what a string means. The checkers query the domain, rate what they find, and tell you what to change.