Back to Free Tools

    Sender Classification Lookup

    Identify every service authorized to send email for your domain and flag unknown sources.

    Classify your domain's senders

    Try:

    What is sender classification?

    Sender classification answers the question: who is authorized to send email for my domain, and is each one intentional?Mailbox providers reject (or quarantine) mail that doesn't trace back to an authorized sender, so the first step of any DMARC rollout is to build a complete inventory of your senders. This tool builds that inventory from your published DNS.

    What this classifier checks

    • Resolves your domain's SPF record and recursively expands every include:
    • Resolves your domain's MX records to identify inbound mail servers
    • Matches each discovered target against a catalog of ~25 known providers (Workspace, ESPs, gateways, help desks)
    • Flags anything that doesn't match as Unknown so you can investigate
    • Categorizes each match (Mailbox, Transactional ESP, Marketing ESP, Security gateway, Help desk, On-prem)

    Sender categories

    CategoryExamplesWhat to check
    Mailbox / WorkspaceGoogle Workspace, Microsoft 365, Zoho MailYour primary mail platform.
    Transactional ESPSendGrid, Mailgun, Postmark, Amazon SESApp-generated mail: receipts, password resets, notifications.
    Marketing ESPMailchimp, Klaviyo, HubSpot, MarketoNewsletters and campaigns — usually needs DKIM aligned via a CNAME you publish.
    Security gatewayMimecast, Proofpoint, BarracudaInbound / outbound filtering. Usually wraps existing mail flow.
    Help desk / CRMZendesk, Intercom, Freshdesk, SalesforceTicket and CRM notifications. Usually has DKIM via CNAME.
    On-prem / HostingYour own MTA or hosting provider's MXConfirm the server is yours and is signing DKIM.
    Unknown—Not in our catalog. Investigate — could be shadow IT or a stale vendor.

    How to handle Unknown senders

    • Ask internally who owns the include: target or MX host — it's often a vendor someone signed up for years ago
    • If the source is no longer used, remove the include: or MX entry from DNS
    • If the source is legitimate, confirm DKIM is signing for your domain — DMARC alignment requires it
    • Re-run this tool after each change to confirm the inventory matches reality

    Frequently asked questions

    Related free tools

    References

    Go beyond one-off checks

    Safer Sender continuously monitors your domain's DMARC, SPF and DKIM, classifies every sender, and guides you safely from p=none to p=reject.

    Start Free View pricing