Security gateway · Cisco Secure Email
Verifying addresses at domains behind Cisco Secure Email
Can you verify addresses at domains behind Cisco Secure Email?
Depends on the domainIt depends on the company. Domains behind Cisco Secure Email are probed like any other.
Cisco Secure Email answers for the company's own mail rules, so the checker treats every domain on its own: it offers a random address first, and if that is accepted the domain is catch-all and results come back risky ("Accepts all addresses"). Otherwise your address gets a per-mailbox answer. It always checks the syntax, the domain's MX records, disposable domains and role addresses such as info@ first.
Mailbox existsMailbox not foundAccepts all addressesCheck one address
Five checks a minute, no account needed. Nothing is sent to the address — we ask its mail server whether the mailbox exists, then disconnect.
Companies whose MX points at mx1.<allocation>.iphmx.com use Cisco Secure Email, formerly IronPort. It rejects unknown recipients during the conversation only when an LDAP accept query runs at that stage; in work-queue mode or without LDAP it accepts first and bounces later, so those domains read as catch-all.
Live DNS snapshot: iphmx.com
Checked 21 October 2026, 07:24 UTCiphmx.com is an MX host suffix, not a mail domain, so this is iphmx.com: a domain whose mail runs through Cisco Secure Email. Read from DNS at the time shown and refreshed at most once a day.
- 10
mx2.cesactivationprod.iphmx.comCisco Secure Email - 10
mx1.cesactivationprod.iphmx.comCisco Secure Email
First MX host belongs to Cisco Secure Email.
v=spf1 exists:%{i}.spf.cesactivationprod.iphmx.com exists:%{i}.spf.cesactivationprodeu.c3s2.iphmx.com ip6:2620:101:2001:d100::b ip6:2620:101:2006:d100::b -allp=none: meets the requirement, but blocks nothing.
v=DMARC1; p=none; aspf=s; adkim=s; ruf=mailto:dmarc_forensic@iphmx.com; rua=mailto:dmarc_aggregate@iphmx.comLook up any other domain with the MX lookup or the email provider lookup.
Cisco Secure Email at a glance
| Operated by | Cisco, through Cisco Secure Email GatewaySource: Cisco AsyncOS 15.0 user guide: LDAP |
|---|---|
| MX hosts | Hosts under iphmx.com; mx1.<allocation>.iphmx.com lists the IPs used in a customer's MX recordsSource: Cisco CES: DNS records and hostnames |
| Address rule | By default the Recipient Access Table rejects all recipients, so only domains or addresses the admin adds are acceptedSource: Cisco: HAT/RAT overview |
| Address rule | An LDAP accept query can reject invalid recipients during the SMTP conversation, or bounce or drop them later, per listener settingsSource: Cisco AsyncOS 15.0 user guide: LDAP |
| Address rule | Directory Harvest Attack Prevention can drop recipients whatever the LDAP accept settingSource: Cisco: configure LDAP accept query |
Why Cisco Secure Email domains can be catch-all or per-mailbox
Domains whose MX points to mx1.<allocation>.iphmx.com use Cisco Secure Email. Its Recipient Access Table accepts only the domains an admin lists, and whether single mailboxes are checked depends on an optional LDAP accept query.
If the LDAP accept query runs during the SMTP conversation, unknown recipients are rejected at RCPT TO and the check gives a per-mailbox answer. In work-queue mode, or with no LDAP query, the gateway accepts first and bounces or drops later, and directory harvest protection can mask results too, so those domains read as catch-all.
What our checker does behind Cisco Secure Email
SimpleVerifier doesn't skip or special-case Cisco Secure Email. For each company domain it offers a random address that can't exist, then your address, and disconnects without sending. If the random address is accepted, the domain is catch-all and its results come back risky with "Accepts all addresses". If it is rejected, your address gets a real answer for that mailbox.
Each check names two recipients in one connection, the random address and yours, and never more. If a Cisco gateway refuses the connection on policy grounds instead of answering about the mailbox, the result comes back risky with "Server refused our check", never invalid.
Cleaning a list full of Cisco Secure Email domains
Split the list by domain, not by platform. Two companies on Cisco Secure Email can behave in opposite ways, so a catch-all result at one says nothing about the next. The bulk catch-all checker finds which domains in a list accept everything before you spend time on single addresses.
For catch-all domains, keep addresses with recent replies or sign-ups and send the rest in a small first batch, suppressing anything that hard-bounces. For per-mailbox domains, trust the verdict: invalid addresses will bounce, and valid ones were accepted by the company's own directory. Accept-all vs unknown results covers the difference.
Common questions
- Can you verify addresses at domains behind Cisco Secure Email?
- It depends on the company. Domains behind Cisco Secure Email are probed like any other. Cisco Secure Email answers for the company's own mail rules, so the checker treats every domain on its own: it offers a random address first, and if that is accepted the domain is catch-all and results come back risky ("Accepts all addresses"). Otherwise your address gets a per-mailbox answer. It always checks the syntax, the domain's MX records, disposable domains and role addresses such as info@ first.
- How do I know if a company uses Cisco Secure Email?
- Look up the domain's MX records. A first MX host ending in iphmx.com means mail goes through Cisco Secure Email. The email provider lookup and MX lookup tools show it for any domain.
- Are domains behind Cisco Secure Email catch-all?
- Some are and some aren't; it depends on how each company configured Cisco Secure Email. A verifier can tell by offering a random address that can't exist: if the domain accepts it, the domain is catch-all and single addresses there can't be confirmed.
- What is iphmx.com in an MX record?
- It is Cisco Secure Email, Cisco's cloud email security service, formerly IronPort. Inbound mail for the domain passes through Cisco's gateways before it reaches the company's own mail server.
Related tools
Got a list with Cisco Secure Email addresses?
Upload the CSV and see how it splits into valid, risky and invalid before you pay. Then clean it with a one-time pack: $9 for 2,500 emails, credits that never expire.