other · CH

Swiss Post

Die Schweizerische Post AG

Swiss postal operator (incl. PostFinance); parcel-delivery lures.

Primary official domain
post.ch
Reviewed official domains
3 (directory review; organization has not verified)
Directory source
DomainSpoof directory · Suggest a correction
Matching domains, 30 days
5
registrable domains containing the brand; source date or last feed observation
First source-reported, 30 days
0
domains first source-reported within 30 days
First observed, 30 days
8
domains first observed by DomainSpoof in feeds
Email policy (primary domain)
DMARC reject
SPF -all · 8/10 lookups · Mail: Not checked · checked 2026-10-18 · published policy

What we watch for

Hostnames in phishing feeds and certificate logs are matched on these brand tokens; feed target labels are matched on the aliases. Generated spellings (typos, lure words, look-alike characters, other top-level domains) are derived from the official domains and tokens and checked against feeds, certificate logs and DNS.

Brand tokens
postfinanceswisspost
Label aliases
PostFinance · Swiss Post
Official domains
post.ch · postfinance.ch · swisspost.ch (all)
Generated spellings
323 tracked · 1 observed somewhere · 322 not observed (all)

Official domains and email policies

Domains reviewed as belonging to Swiss Post. DMARC helps receivers check the From domain; lookalike domains remain possible. Published policies cannot confirm actual mail configuration or receiver behavior.

DomainRelationshipEvidenceDMARC policyPolicy sourceSPFReportingMailDKIMMTA-STSLast check
post.ch
primaryReviewed 2026-10-18
DomainSpoof directory (curated)rejectDirect-all · 8/10 lookupsAggregate reports requested (rua)Not checkedUnknown (no known selector)
Not checkedNot checked
2026-10-18 22:58 UTC
Records and check details

Published records

DMARC (_dmarc.post.ch)
v=DMARC1; p=reject; sp=reject; rua=mailto:…@post.ch; ruf=mailto:…@post.ch; rf=afrf; pct=100; ri=86400; fo=1;
SPF (post.ch)
v=spf1 mx a:mx3.post.ch a:mx4.post.ch a:mx5.post.ch a:relay1.post.ch a:relay2.post.ch include:_edge.post.ch a:mail.postcardcreator.post.ch -all
MX (post.ch)
Not checked
DKIM
Unknown (no known selector). DKIM use requires a known selector or message to assess; a published key alone cannot confirm signing, and no key at the probed common selectors proves nothing.
MTA-STS (_mta-sts.post.ch)
Not checked
TLS-RPT (_smtp._tls.post.ch)
Not checked

Interpretation

  • p=reject: receivers are asked to reject failing mail.
  • Relaxed DKIM alignment (default).
  • Relaxed SPF alignment (default).
  • pct=100 is a legacy tag removed by RFC 9989; its effect is receiver-dependent.
  • rf is a legacy tag removed by RFC 9989.
  • ri is a legacy tag removed by RFC 9989.
  • -all: unlisted hosts fail SPF.
  • 8 DNS-querying terms (include, a, mx, ptr, exists, redirect), counted recursively; the limit is 10.
  • Static check of the published record: syntax, every referenced include/redirect record, the DNS-lookup count and a/mx/exists targets (resolved to count void lookups). It does not evaluate SPF for any particular sending host.

DMARC discovery (RFC 9989 tree walk)

  1. _dmarc.post.ch: ok, 1 DMARC record

Recent checks

  • 2026-10-18 22:58 UTC: DMARC reject; SPF -all

Assessment posture-v2. DNS lookup failures leave the policy unknown.

postfinance.ch
subsidiaryReviewed 2026-10-18
DomainSpoof directory (curated)quarantineDirect-all · 7/10 lookupsAggregate reports requested (rua)Not checkedUnknown (no known selector)
Not checkedNot checked
2026-10-18 22:58 UTC
Records and check details

Published records

DMARC (_dmarc.postfinance.ch)
v=DMARC1; p=quarantine; sp=none; rua=mailto:…@postfinance.ch; ruf=mailto:…@postfinance.ch; rf=afrf; pct=70; ri=86400; fo=0:1:s;
SPF (postfinance.ch)
v=spf1 mx a:mx3.post.ch a:mx4.post.ch a:mx5.post.ch a:relay1.post.ch a:relay2.post.ch include:_edge.post.ch -all
MX (postfinance.ch)
Not checked
DKIM
Unknown (no known selector). DKIM use requires a known selector or message to assess; a published key alone cannot confirm signing, and no key at the probed common selectors proves nothing.
MTA-STS (_mta-sts.postfinance.ch)
Not checked
TLS-RPT (_smtp._tls.postfinance.ch)
Not checked

Interpretation

  • p=quarantine: receivers are asked to treat failing mail as suspicious.
  • Subdomain policy sp=none differs from p=quarantine.
  • Relaxed DKIM alignment (default).
  • Relaxed SPF alignment (default).
  • pct=70 is a legacy tag removed by RFC 9989; its effect is receiver-dependent.
  • rf is a legacy tag removed by RFC 9989.
  • ri is a legacy tag removed by RFC 9989.
  • -all: unlisted hosts fail SPF.
  • 7 DNS-querying terms (include, a, mx, ptr, exists, redirect), counted recursively; the limit is 10.
  • Static check of the published record: syntax, every referenced include/redirect record, the DNS-lookup count and a/mx/exists targets (resolved to count void lookups). It does not evaluate SPF for any particular sending host.

Observations

  • DMARC: Weaker subdomain exception: sp=none is weaker than p=quarantine

DMARC discovery (RFC 9989 tree walk)

  1. _dmarc.postfinance.ch: ok, 1 DMARC record

Recent checks

  • 2026-10-18 22:58 UTC: DMARC quarantine; SPF -all

Assessment posture-v2. DNS lookup failures leave the policy unknown.

swisspost.ch
subsidiaryReviewed 2026-10-18
DomainSpoof directory (curated)rejectDirect-all · 5/10 lookupsAggregate reports requested (rua)Not checkedUnknown (no known selector)
Not checkedNot checked
2026-10-18 22:58 UTC
Records and check details

Published records

DMARC (_dmarc.swisspost.ch)
v=DMARC1; p=reject; sp=reject; rua=mailto:…@swisspost.ch; ruf=mailto:…@swisspost.ch; rf=afrf; pct=100; ri=86400; fo=1;
SPF (swisspost.ch)
v=spf1 mx a:mx3.post.ch a:relay1.post.ch a:relay2.post.ch include:_edge.post.ch -all
MX (swisspost.ch)
Not checked
DKIM
Unknown (no known selector). DKIM use requires a known selector or message to assess; a published key alone cannot confirm signing, and no key at the probed common selectors proves nothing.
MTA-STS (_mta-sts.swisspost.ch)
Not checked
TLS-RPT (_smtp._tls.swisspost.ch)
Not checked

Interpretation

  • p=reject: receivers are asked to reject failing mail.
  • Relaxed DKIM alignment (default).
  • Relaxed SPF alignment (default).
  • pct=100 is a legacy tag removed by RFC 9989; its effect is receiver-dependent.
  • rf is a legacy tag removed by RFC 9989.
  • ri is a legacy tag removed by RFC 9989.
  • -all: unlisted hosts fail SPF.
  • 5 DNS-querying terms (include, a, mx, ptr, exists, redirect), counted recursively; the limit is 10.
  • Static check of the published record: syntax, every referenced include/redirect record, the DNS-lookup count and a/mx/exists targets (resolved to count void lookups). It does not evaluate SPF for any particular sending host.

DMARC discovery (RFC 9989 tree walk)

  1. _dmarc.swisspost.ch: ok, 1 DMARC record

Recent checks

  • 2026-10-18 22:58 UTC: DMARC reject; SPF -all

Assessment posture-v2. DNS lookup failures leave the policy unknown.

“Not checked”: no check yet (mail, DKIM and MTA-STS facts were added later, so older checks show “Not checked” for them). “Lookup failed”: DNS result unknown. DKIM is probed at a fixed list of common selectors only. Report mailbox names are redacted.

Reports on official domains appear under “Official assets with reports” on the Reported matches tab.