northwind.example

Checks that mail for northwind.example really goes through iBlockSpam and can't go around it.

• Pass All MX records point to iBlockSpam

  Every MX record for northwind.example points to the filtering servers.

• Unknown Partner inbound connector restricted to iBlockSpam

  Connector settings can't be seen from outside your tenant. Check the connector's security restrictions in the Exchange admin center.

  Connector and Enhanced Filtering guide

• Unknown Enhanced Filtering for Connectors is on

  This can't be checked from outside your tenant. In a received message's headers, X-MS-Exchange-ExternalOriginalInternetSender shows it worked.

  How to verify it

• Pass Your outgoing mail passes SPF, DKIM and DMARC

  SPF, DKIM and DMARC all passed and match northwind.example.

• Optional SPF authorizes the iBlockSpam outbound relay (optional)

  Not included. Only needed if you send mail through the iBlockSpam outbound relay; then add include:_spf.iblockspam.com to your SPF record.

• Pass A test message arrived through the filter

  Confirmed.

Inbound messages

14,627

Delivered

10,234

Held as spam

4,39330% of inbound

In quarantine now

214

Last synced 3 hours ago (Sep 12 – Oct 11). "Held" means the filtering service kept the message out of your inbox (spam, viruses, phishing, blocked senders); you can review and release held mail in the filtering panel.

Last SPF/DMARC check

5 hours ago

Last MX check

4 minutes ago

Last change

Oct 8, 2026

Recent changes

• Check this Your SPF record changed SPF · Oct 8, 2026 09:38 UTC

  Beforev=spf1 include:spf.protection.outlook.com -all Nowv=spf1 include:spf.protection.outlook.com include:servers.mcsv.net -all

  Added include:servers.mcsv.net (Mailchimp).

  Mailchimp can now send mail that passes SPF as northwind.example.

  What to do: If someone on your team set up Mailchimp, nothing to do. If not, remove the include and find out who added it.

  Emailed to owners and admins 4 days ago.

• For your information Your DMARC policy is stricter DMARC · Sep 19, 2026 09:31 UTC

  Beforev=DMARC1; p=none; rua=mailto:dmarc@iblockspam.com,mailto:it@northwind.example Nowv=DMARC1; p=quarantine; rua=mailto:dmarc@iblockspam.com,mailto:it@northwind.example

  Policy changed from p=none to p=quarantine.

  Receivers now send mail that fails DMARC to spam instead of delivering it.

  What to do: Watch DMARC monitoring for a week or two. If your own senders keep passing, you can move to p=reject.

  Emailed to owners and admins 3 weeks ago.

• For your information Mail for northwind.example now goes through iBlockSpam MX (mail routing) · Aug 13, 2026 09:24 UTC

  BeforeMX records do not point to iBlockSpam: northwind-example.mail.protection.outlook.com NowAll MX records point to iBlockSpam: mx1.filter.example, mx2.filter.example

  All MX records now point to iBlockSpam.

  Inbound mail is filtered before it reaches Microsoft 365.

  What to do: Nothing. Keep your previous MX record written down in case you ever need to roll back.

  Emailed to owners and admins 1 month ago.

Domain Watch reads public DNS. A change you made on purpose needs no action: it becomes the baseline for future checks.

Mailbox providers such as Google, Microsoft and Yahoo send daily DMARC reports about mail that uses northwind.example in its From address. We collect them at dmarc@iblockspam.com, show who sends as your domain and whether it passes, and tell you when it's safe to move to a stricter policy.

Our report address

Ready

Your DMARC record

Sends reports to us

Check again

Reports, last 30 days

117

From google.com, Outlook.com, Yahoo, comcast.net and others

Last 30 days

Messages reported

3,653

Passed DMARC

95.8%

aligned SPF or DKIM

Your senders passing

98.8%

excludes unknown sources and forwarding

Unknown or spoofed

18

messages that failed SPF and DKIM

Needs attention

• Check41 of 213 messages from 192.0.2.61 (mx.patientportal.example) failed DMARC

  This source also sends mail that passes, so it is probably yours. Make sure SPF includes it and that it DKIM-signs every message.

• Unknown sender18 messages from 203.0.113.77 failed SPF and DKIM

  Nothing authenticated this mail. If you don't recognise the sender, it is likely spoofing; a quarantine or reject policy stops it.

Top sending sources

Counts come from the reports receivers send; not every receiver sends them, so totals are lower than the mail you actually send. "Forwarded mail" passed DKIM but not SPF, which is normal for forwarding and mailing lists. Host names are shown only as reported by reverse DNS; we label a known provider only when the name resolves back to the same address.

We check typo and look-alike versions of northwind.example (a missing or swapped letter, rn for m, 0 for o, other endings like .net or .co, look-alike international characters) in public DNS and Certificate Transparency logs. We email owners and admins when one is newly registered or gets a mail server.

• High nortwind.example

  Missing letter · Mail server (MX): mail.nortwind.example; website address (A record); 2 TLS certificates (latest Oct 5, 2026)

  First seen registered Oct 3, 2026. Mail server seen Oct 6, 2026. Emailed to owners and admins Oct 6, 2026.

  Known / ours

• Medium northvvind.example

  Look-alike characters · Website address (A record); 1 TLS certificate (latest Sep 3, 2026)

  Already registered when monitoring started (Sep 1, 2026).

  Known / ours

• Medium northwind.test

  Same name, different ending · Registered, nothing set up yet

  Already registered when monitoring started (Sep 1, 2026).

  Known / ours

• Medium nоrthwind.example xn--nrthwind-nbh.example

  Look-alike international characters · Registered, nothing set up yet; 1 TLS certificate (latest Sep 29, 2026)

  First seen registered Sep 27, 2026. Emailed to owners and admins Sep 27, 2026.

  Known / ours

A registration on its own isn't proof of an attack, and we can't see who registered a domain. A lookup that fails is retried the next day, never reported as "not registered".