inbox.com email servers, SPF and DMARC

inbox.com publishes a single MX host, mx.dka.mailcore.net. With no backup host, a sender that can't reach it queues the message and retries until the server answers or the queue gives up.

8 other domains we checked on the same day also route mail to hosts under mailcore.net, with different records from inbox.com: getmail.no, hot.ee, jubii.dk, luukku.com, neti.ee, pp.inet.fi, start.no and vipmail.hu.

The record on 5 November 2026 was v=spf1 include:spf.mailcore.net include:mail.zendesk.com -all.

In plain terms, it delegates to spf.mailcore.net and mail.zendesk.com. The top level uses 2 DNS-querying terms; SPF allows 10 in total including nested includes (RFC 7208 §4.6.4).

It ends in a hard fail (-all): receivers may reject mail from any server the record does not list.

The record is v=DMARC1; p=reject; adkim=s; aspf=s; fo=1; sp=reject; ruf=mailto:[email protected]; rua=mailto:[email protected];.

p=reject asks receivers to refuse mail that fails DMARC.

Aggregate reports go to dmarc-reports.cloudflare.net, so the domain's owner sees who sends mail as @inbox.com.

What that means for you: if a contact gives an @inbox.com address and you send to them, nothing changes. But never put an @inbox.com address in the From line of mail sent through your own tool or ESP. It can't pass DMARC for inbox.com, and this policy tells receivers to refuse it.

_mta-sts.inbox.com publishes v=STSv1; id=20260925000000, so inbox.com uses MTA-STS: sending servers that support it must deliver over verified TLS or not at all (RFC 8461).

It also asks for TLS reports with v=TLSRPTv1; rua=mailto:[email protected] (RFC 8460).

4 other domains published exactly the same MX hosts and SPF record as inbox.com on 5 November 2026: citromail.hu, email.it, indamail.hu and webmail.co.za. Mail to any of them lands on the same servers.

Our checker treats @inbox.com like any domain: syntax, MX, disposable and role checks first, then a made-up address to rule out a catch-all, then your address at RCPT TO, disconnecting without sending. We have not published a test of how mx.dka.mailcore.net answers for @inbox.com, so we make no claim here about whether single mailboxes can be confirmed; each result carries its own reason.

DNS tells you where mail goes, not whether one person's mailbox still exists. For a list, run the whole file through a verifier before you send: invalid rows come out, risky rows (catch-all, unknown, refused) go in their own segment, and valid rows are safe to mail.