Dataweaz

si.edu

Summary

Registrar
—
Status
Created on
June 19, 1992
Expires on
July 31, 2027
Name servers
a9-64.akam.net, a28-65.akam.net, a24-67.akam.net, a26-66.akam.net, a1-88.akam.net, a11-67.akam.net
Mail servers
si-edu.mail.protection.outlook.com
DMARC
Reject
SPF
Strict
DKIM
6 keys found
Website
See the website

Spoofing protection (DMARC)

Reject

E-mails spoofing this domain are rejected.

DMARC tells mail servers what to do with an e-mail that claims to come from si.edu but fails SPF and DKIM checks.

Policy
Reject
Subdomain policy
Reject
Messages covered
100%
DKIM alignment
Relaxed
SPF alignment
Relaxed
Aggregate reports
[email protected], [email protected], [email protected]
Failure reports
[email protected], [email protected]

Record

v=DMARC1; p=reject; fo=1; rua=mailto:[email protected],mailto:[email protected],mailto:[email protected]; ruf=mailto:[email protected],mailto:[email protected]; adkim=r; aspf=r; pct=100;

Authorized senders (SPF)

Strict

E-mails sent by any other server are rejected.

SPF lists the servers allowed to send e-mails for si.edu.

RuleValueResult
ip4160.111.0.0/16Allowed
ip467.231.156.100Allowed
ip467.231.148.101Allowed
includespf1.si.eduAllowed
includespf.protection.outlook.comAllowed
includemailsenders.netsuite.comAllowed
all—Rejected

Top-level DNS lookups: 3 of 10 allowed

Record

v=spf1 ip4:160.111.0.0/16 ip4:67.231.156.100 ip4:67.231.148.101 include:spf1.si.edu include:spf.protection.outlook.com include:mailsenders.netsuite.com -all

E-mail signing (DKIM)

DKIM keys published by si.edu under the most common selectors. Other keys may exist under selectors specific to each sending service.

SelectorLikely serviceKeyStatus
selector1Microsoft 365RSA 1024 bits · shortActive
k1MailchimpRSA 1024 bits · shortActive
mandrillMandrillRSA 1024 bits · shortActive
s1SendGridRSA 2048 bitsActive
s2SendGridRSA 1024 bits · shortActive
default—RSA 1024 bits · shortActive

RSA keys shorter than 2048 bits, called short keys, are discouraged: they are easier to break.

MX, SPF, DKIM and DMARC: the e-mail records

Four DNS records make a domain's e-mail work. MX says where e-mails sent to si.edu arrive; SPF, DKIM and DMARC let mail servers check that an e-mail claiming to come from si.edu was really sent by this domain, which protects it against spoofing.

MX

An MX (Mail Exchanger) record designates a server that receives e-mails sent to the domain. When someone writes to an @si.edu address, their mail server queries the DNS for the domain's MX records, then delivers the message to the server they point to.

Example record

si.edu  MX  10 mx1.si.edu.
si.edu  MX  20 mx2.si.edu.

What the record contains

10, 20
Priority: the server with the lowest number is tried first. Servers with equal priority share the load.
mx1.si.edu.
Host name of the mail server. It must point to an A or AAAA record: an IP address or an alias (CNAME) is not allowed here.
0 .
An MX "0 .", called a null MX, declares that the domain accepts no e-mail: sending servers give up at once instead of retrying.

Declaring at least two servers with different priorities avoids losing e-mails during an outage: sending servers retry for several days and fall back on the backup server. Without any MX, they try to deliver directly to the IP address of the domain.

SPF

SPF (Sender Policy Framework) is a TXT record listing the servers allowed to send e-mails on behalf of the domain. The receiving server checks that the sender is on this list. The final "all" rule says what to do with other servers: reject them (-all), flag their e-mails as suspicious (~all) or make no decision (?all).

Example record

si.edu  TXT  "v=spf1 mx include:_spf.google.com ip4:192.0.2.10 -all"

What the record contains

v=spf1
Identifies the record as an SPF policy. It must come first.
ip4, ip6
Allows a specific IP address or an address range, for example ip4:192.0.2.0/24.
a, mx
Allows the addresses of the domain itself (A record) or those of its mail servers (MX).
include
Allows the servers of another domain, usually a sending service: include:_spf.google.com for Google Workspace.
-all, ~all
Final rule, applied to every other server. Its qualifier decides what happens to them: - rejects them, ~ flags their e-mails as suspicious, ? makes no decision, + accepts them (avoid it).

A domain must publish only one SPF record, and its evaluation cannot exceed 10 DNS lookups (include, a, mx, exists, redirect). Beyond that, mail servers treat it as invalid.

DKIM

DKIM (DomainKeys Identified Mail) signs every outgoing e-mail with a private key. The matching public key is published in a TXT record at selector._domainkey.si.edu, so the recipient can check that the message really comes from the domain and was not altered on the way. The selector is chosen by each sending service and cannot be guessed: Dataweaz checks the most common ones (Google Workspace, Microsoft 365, Mailchimp, SendGrid…), so a key published under another selector may exist without appearing here.

Example record

google._domainkey.si.edu  TXT  "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA…"

What the record contains

v=DKIM1
Protocol version. Optional but recommended, in which case it must come first.
k
Key algorithm: rsa, the most common, or ed25519.
p
Public key, base64-encoded. An empty value means the key has been revoked.
t
Flags: y marks a key in testing, whose failures must not be penalized; s forbids its use for subdomains.

Each sending service publishes its key under its own selector (google, selector1, k1…), which allows several keys and seamless rotation. A 2048-bit RSA key is recommended today.

DMARC

DMARC (Domain-based Message Authentication, Reporting and Conformance) builds on SPF and DKIM. Published on _dmarc.si.edu, it tells mail servers what to do with an e-mail that fails these checks (let it through, send it to spam or reject it) and where to send reports.

Example record

_dmarc.si.edu  TXT  "v=DMARC1; p=quarantine; rua=mailto:[email protected]; adkim=r; aspf=r"

What the record contains

v=DMARC1
Identifies the record as a DMARC policy. It must come first.
p
Policy applied to e-mails that fail the checks: none (monitoring only), quarantine (spam folder) or reject.
sp
Subdomain policy. Without it, subdomains follow the domain's policy.
rua
Address that receives daily aggregate reports about e-mails sent on behalf of the domain, whether they pass the checks or not.
ruf
Address that receives detailed failure reports, message by message. Few providers still send them.
pct
Percentage of e-mails subject to the policy, for a gradual rollout. 100 by default.
adkim, aspf
DKIM and SPF alignment: r (relaxed, a subdomain of the same domain is enough) or s (strict, the domain must be identical).

To roll out DMARC without blocking legitimate e-mails, start with p=none and an rua address, analyze the reports to find every service sending on behalf of the domain, then move to quarantine and finally to reject.

DNS records of si.edu

IP addresses (A and AAAA)

An A record maps the domain name to an IPv4 address: the address of the server that browsers contact to display the website. The AAAA record does the same for an IPv6 address. A domain can have several of them to spread visits across several servers.

TypeIP address
A160.111.244.22

Name servers (NS)

NS records designate the authoritative DNS servers of the domain: they answer every question about its other records (A, MX, TXT…). They are provided by the registrar, the hosting provider or a dedicated DNS service, and several servers are declared so that the domain keeps working if one of them fails.

ServerIP address
a9-64.akam.net184.85.248.64
a28-65.akam.net95.100.173.65
a24-67.akam.net2.16.130.67
a26-66.akam.net23.74.25.66
a1-88.akam.net193.108.91.88
a11-67.akam.net84.53.139.67

Mail servers (MX)

MX records point to the servers that receive e-mails sent to the domain, that is to @si.edu addresses. Each server has a priority: the one with the lowest number is tried first, the others take over if it fails. Without an MX record, the domain cannot receive e-mails.

PriorityServerIP address
0si-edu.mail.protection.outlook.com52.101.60.148

TXT records

TXT records hold free text. They are used to prove ownership of the domain to online services (Google, Microsoft, Facebook…) and to publish e-mail security rules: SPF on the domain itself, DMARC on _dmarc.si.edu.

NameContent
si.edu520551a893da3ebec689738534dcc320a2265c162236dbde97b39a026cd87fb6
si.edupardot980712=40b77e6a8c3cb064ca443f8d3483406a462ed6e8096c597515102540924fa4ed
si.edu04a376ab7769590c9661fc0941631e28f4055d41005260b40fff3c87d8df9869
si.edufaeacb31d37c71bd733abb60f275e2b68b82f977fa17f48f377fd0824dfea1d1
si.edu82bfa18d46385ec9599afca5ae30e6f718c8383c062699c76e894b62e9df8e79
si.eduv=spf1 ip4:160.111.0.0/16 ip4:67.231.156.100 ip4:67.231.148.101 include:spf1.si.edu include:spf.protection.outlook.com include:mailsenders.netsuite.com -all
si.edu14cdba3c0c616a8ce86008cf5436804e406cdff63a73d44cdb943331fe716c5d
si.edu1209cfa51bcf735615577b69ddaddc125e40063092c69453ef8b2c90e9db5aa1
si.edua37dc5ea443ef274ee1bbf4d014c312e4a36bf28c28204b033f914f932bd45dc
si.eduae4702faaef4287671c09ea00d6ee406f27390cef064da2f1ea20268e56d92c2
si.eduatlassian-domain-verification=WsqpJRrIShm2l9mzMRIOQjdSiHChgFqqfOMIUH4B3EDLiaodZLfVZsitwXvvOuzo
si.edu7d4550321c0161253c3ea5ccec6c837f8bcf7be735038aa9f653a72d98eec4bc
si.edub3885056fb9ee4649ca08b2d7f5aee42ad8524f090e1d4bc1ebf388f41695af4
si.edud2c638e312f5d2bf17a1c5295c39c1b51200c5caff4fafe25ac4f7345d4825aa
si.edudocusign=1c9206b6-fcd1-4754-8bb5-dc9f864d2d2e
si.eduf625192959685de445110b63c95ea6f12e17d96e36e9c3e9e0a938c30a4f43ba
si.edue85d3013c9c7b3189294607235b7649ecb79aca52fea7d56cd63f8ff0bdd3759
si.edub81949f9493326bea1ceae862c879b1a6688f02762ade1c2211702ebb1d5af05
si.edu31802817b6579c3d802ca2f1680d394b657eb4788178951026ace15baafb5588
si.eduf0afb2e46e0da6455ff974d8d351d6ed3a5520b5fa607284d71e8624f07608a0
si.edu103981a55790ab5e79fa42a3be5ec1f1af9688531c1d7201da7b423e1a9afe98
si.eduasv=84f6dfbd71d6cbaaa0ed4810076c50f6
si.eduairtable-verification=3f1db8793cf1be25596af7e99e060d41
si.eduadobe-idp-site-verification=ebf44aa1f4d5c71b36a262511b68415832b6f2ad1b7411c528806154df4cc7a6
si.edu69590cb29bef8c8cc7c9b2e65dc042877bf1f8d8ad89d454339a554f4a6657bf
si.edupardot1004652=926ad95006c2c225fb35c6cf36285e8b112f6756b832538f471e4cbf886f11c0
si.eduMS=ms11507808
si.eduonetrust-domain-verification=733d52d8e41444d097693c749e597ec9
si.eduapple-domain-verification=OQGHn6kF8gOnAiWs
si.eduae526ed1432cc584889cd7864aeb421535f15c4446220a7fef0084779b769e72
si.edu082b9cc317ff878149172c86c461af33b77e375cf70a4eea971a25418ef906d5
si.edu8b581bbbb2fffb6a643e039a6eac27e87f1fb3cc77a63dbf46a1945364b84f1f
si.edu9d9f681dca718bea2c480bb46cd0c1ecca4329b3f9e21616bc836d45916defc9
si.edu0aaea9bca148850c1b6f223e7f57a777232e5a319343f6d8989514c236f298fa
si.edujamf-site-verification=_2xGbG2MJiUanzZxmwyiBA
si.eduf32a1ad19f5e57b68f5bba3bcac88ad61fd110d2eefe9cc12cc05c8bbecf5031
si.edu4aa7b65339612a9a90d4cebadbb570d0ea68be025de69c1f11a1a14207cfdedb
si.edudocusign=13c4cb8d-4a47-4283-811e-e667bdd84098
si.edugoogle-site-verification=9-OyClmReEWU6t3ri7R65zaHcE5ONk80xgeIHMjgg08
si.edu270f64f6d25ce95f3dee98221993750128f27e3c77866485b5a589f4d00ec863
si.edu060016681f61e250780cb31c60e8e9c59232b1a6a96c84f4e6df6241169a80d2
si.eduD9Pafp4mPMV7Vt+wH+GSYi35FnsBm9zZQA6TLxStwyHV3JFiCPPQGVSJM7UzuvWz/KrphLEsXbc/bs5vKq+iHQ==
si.edu99150e590fc6c7a503eddbc238c57319e437e396766bafb797c36d78f4fc3fe1
si.edu02903de83f211f7c1c93dbbfaf24f4de1222fb631d64214c20f5aa76f0cbb2b1
si.edu7ad39b33bb809dff48ffc936a730927bc47c1b0ce9ef0e5956ffcd3707c7207e
si.edu3e449f3017316ed138f1d4a6d4be9346a440a6100bb1f1e749992ae4430a7e74
si.edub5619ec13807b9baa5d942538745a66b67dbf3c844edbd82f227cbf539fecd83
si.edud0979ba3450a12a765a08ae0190e39832ff0175cade82a341307a3291532e19d
si.eduv=spf2.0/pra ?all
si.eduf27120e7e7d9fde4b8b1d550a8676808f32423c68f65bf080257153124065865
si.edu39433829e8c04de67882088be1ceb6eb7300dd8d405217affb631c652d2c92bd
si.eduopenai-domain-verification=dv-eu9pCkdZuzJSXWszEh1cs3BG
si.edu2fa42e7886b78a66bd2e4010268ee32d674f9966c27c327bece432e50daa5ef4
si.edu085b91e4eb1a7a8572dcf79376104572dd8caf625df8797c2459f62dbd6f8757
si.educanva-site-verification=_s6Cq2oLPbhyDq31iu-b-A
si.edu4f91259469ca9960db5699179cb910796852693ba7df70b60545f79373c5d0e2
si.edu18aa19c7c343e9bdc9c2a6bb9cda5dabb4355c68d8e5932ccd6381651e126505
si.edugoogle-site-verification=h1dnhf4Bz-gK562okiF7P9C6hy5xTOc_7v-4ChAOpHo
si.edu494983b036c42cf817dacb5fc919f629c3786991041ddc257fc4014ce1c7886b
si.edu97bf4b9ed60aea1d02f2aeaafc4a2941a8a5c647a0792a8165ea444a7cc34ca7
si.edu6dee22b4868a2c91e999fd11037713c59d89df90570f080386c6719737c39527
si.edugoogle-site-verification=kanYvoMvgHV_OzXszl4r6hoaRhJ-RSmcKHmMNYbJLM0
si.eduFoxit-domain-verification=90c4cab4414ce9a2004043298dd584ce
si.eduatlassian-domain-verification=/lJYot74zjF1VwfCEfyelSmp2V3z5QnHGSWtBhaZzLjy3KajAZuREvkSONV5/oY5
_dmarc.si.eduv=DMARC1; p=reject; fo=1; rua=mailto:[email protected],mailto:[email protected],mailto:[email protected]; ruf=mailto:[email protected],mailto:[email protected]; adkim=r; aspf=r; pct=100;
selector1._domainkey.si.eduv=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDED/cqPO8iKqQBnSBFQW3gid5OWulrkxU7bfFaB6k+gVQDu5iOpZQWp7cOVU0UZzR9sfsaA4SqoQ0yW9rT1F46j7RVHKy1dgy4koloky/CJETjpmZOw1aYKUr/7ufde4TWzS28mQ+WKXuk41kNSNAIuZyWTmHedp40Jf2uJAzsKQIDAQAB;
k1._domainkey.si.eduk=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDbNrX2cY/GUKIFx2G/1I00ftdAj713WP9AQ1xir85i89sA2guU0ta4UX1Xzm06XIU6iBP41VwmPwBGRNofhBVR+e6WHUoNyIR4Bn84LVcfZE20rmDeXQblIupNWBqLXM1Q+VieI/eZu/7k9/vOkLSaQQdml4Cv8lb3PcnluMVIhQIDAQAB;
mandrill._domainkey.si.eduv=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCrLHiExVd55zd/IQ/J/mRwSRMAocV/hMB3jXwaHH36d9NaVynQFYV8NaWi69c1veUtRzGt7yAioXqLj7Z4TeEUoOLgrKsn8YnckGs9i3B3tVFB+Ch/4mPhXWiNfNdynHWBcPcbJ8kjEQ2U8y78dHZj1YeRXXVvWob2OaKynO8/lQIDAQAB
s1._domainkey.si.eduk=rsa; t=s; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA709tzrZbxNkaFES1AgqV/RpDA01sEgTVoeerd+5Q4U3KJVYzCb3IApE0N0yDl0siDRcqJTMb2GpRBwiCbM0Qd1waJqmnGOcZtHI4cszdhpKTCtrwbuahGqY+hwh3I+ia6BQu6OJP/aUfJaIq8w4A5RERrXF9HMtsGSm546T1hqOEoYPeg7AqKxkf/9XAOge/0CFge0K2F2xbD+Q6+6JNruX6SflVnYW2gdrbC+QSoa1AUYhSQ2uXFyhRtSBbFLH/Dpb66M6jFAOA6eZU2QYDtV/boqenA6xxIVDqW8+GbztK1cst3KFassv1KQnIzhPvsTgsGTOP9luOptFVo8RV7wIDAQAB
s2._domainkey.si.eduk=rsa; t=s; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC+phHM+UiPVFWIZg00C5jKKlMWeI3MfcdaR9fFDHe92x6InJU0q7EUotkHcRv8/mH3z36VN21zXLXvrgnMMraZs4JHPPHQ8I7pdIW2mYnqKZJOTUAPVpOAB0/9LEvSpQq3IFyr/Z5L+9Qmt7jYpzna9VkpmEJhs5/CXjzzKsiJSQIDAQAB
default._domainkey.si.eduv=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDf3px0BX68c5Ndt4fsjjhIauO0XimgTnf7isoP19qlbIBoPO7GY3Gp7QkE9XEmIBSlkOqs+RkZ8gQq8HXPqAD36rnylthB9ZZnwhXMmpJ5Ibvxc2BvaXAxi0BVUT3g0UIeakxB5vWohjDj4aZ2QXCfodMGari/QdQHwvdYF04tbwIDAQAB

Related IP addresses

IPv4 addresses used by si.edu: website, name servers, mail servers and senders authorized by SPF.

IP addressUsed for/24 block
160.111.244.22Website160.111.244.0/24
184.85.248.64Name server a9-64.akam.net184.85.248.0/24
95.100.173.65Name server a28-65.akam.net95.100.173.0/24
2.16.130.67Name server a24-67.akam.net2.16.130.0/24
23.74.25.66Name server a26-66.akam.net23.74.25.0/24
193.108.91.88Name server a1-88.akam.net193.108.91.0/24
84.53.139.67Name server a11-67.akam.net84.53.139.0/24
52.101.60.148Mail server si-edu.mail.protection.outlook.com52.101.60.0/24
67.231.156.100Authorized by SPF67.231.156.0/24
67.231.148.101Authorized by SPF67.231.148.0/24

WHOIS of the domain si.edu

This Registry database contains ONLY .EDU domains.
The data in the EDUCAUSE Whois database is provided
by EDUCAUSE for information purposes in order to
assist in the process of obtaining information about
or related to .edu domain registration records.

The EDUCAUSE Whois database is authoritative for the
.EDU domain.

A Web interface for the .EDU EDUCAUSE Whois Server is
available at: http://whois.educause.edu

By submitting a Whois query, you agree that this information
will not be used to allow, enable, or otherwise support
the transmission of unsolicited commercial advertising or
solicitations via e-mail.  The use of electronic processes to
harvest information from this server is generally prohibited
except as reasonably necessary to register or modify .edu
domain names.

-------------------------------------------------------------

Domain Name: SI.EDU

Registrant:
	Smithsonian Institution
	380 Herndon Parkway
	Herndon, VA 20170
	USA

Administrative Contact:
	Brian Alpert
	Smithsonian Institution
	380 Herndon Parkway, MRC 1010
	Herndon, VA 20170
	USA
	+1.2026333955
	[email protected]

Technical Contact:
	Joseph Johnston
	Smithsonian Institution
	380 Herndon Parkway
	Herndon, VA 20170
	USA
	+1.2026332715
	[email protected]

Name Servers:
	A9-64.AKAM.NET
	A1-88.AKAM.NET
	A26-66.AKAM.NET
	A28-65.AKAM.NET
	A24-67.AKAM.NET
	A11-67.AKAM.NET

Domain record activated:    19-Jun-1992
Domain record last updated: 13-Jan-2026
Domain expires:             31-Jul-2027

% Query time: 449 msec
% WHEN: Fri Oct 02 11:03:47 UTC 2026