MX Record Lookup
Check mail servers for a domain.
Asked from our server in Newark, US · the MX records, each mail server on port 25, and the domain’s mail security
DNS sends the records unsorted; senders try the lowest priority first
Press Look up to map where gmail.com’s mail goes
- Domain
- MTA-STS ring
- Mail server · lamp lit = answers
- IPv4 · IPv6
- Port 25 from Newark
- Network
How senders choose a server New
An illustration of this lookup’s own resultsHow senders choose: the lowest priority number first; the others wait as backups. The envelope is an illustration: we never send a message.
After the lookup, close the first server and watch where mail would go next. It replays this lookup’s own results; nothing is checked again.
The lookup’s path New
Findings
Counted, never scoredWe never send email · recent lookups stay in this browser
The mail sky, as a list
Every star above is a row here, and every row is a star. Hover one to light the other.
Findings New
What stands out, counted by state. Never a score.
What to do New
Plain steps, in the order that helps most.
Each mail server, in the order senders try them New
Its addresses and their reverse DNS, the five checks, and what happened on port 25.
Transport security New
Whether senders must use TLS, where they report failures, and DANE and DNSSEC.
Our copy vs the domain’s own New
Changed provider but still see the old servers? Compare our resolver’s cached copy with the domain’s own name server.
Spread New
How many servers, how many work, and how many networks and places they sit in. Plain counts.
Blocklists New
Each mail server’s public IPv4 address on the six free DNS blocklists, asked by our resolver.
A listing matters when the same server sends mail: other servers may refuse what it sends. Mail coming to this domain isn’t blocked by it. We don’t delist anyone.
SPF and DMARC, at a glance
MX records only cover incoming mail. These two say who may send as the domain.
How we looked it up New
Every question went from our server in Newark, US.
The answer, dig styleText
Raw JSONJSON
Recent lookups
Kept in this browser only, with the server count and the result at the time.
Kept in this browser only · nothing is sentPress a domain to look it up again
What the MX record lookup does
MX records tell the rest of the internet where to deliver email for a domain. When someone writes to an address at example.com, their mail server looks up the MX records for example.com and hands the message to a server listed there, trying the lowest priority number first. The MX record lookup asks for those records from our server in Newark, US, and puts them in the order senders try them.
It then checks each mail server the way a sender would. It finds the server’s addresses and their reverse DNS names, and connects on port 25: it reads the server’s greeting, says hello, asks for STARTTLS and looks at the certificate the server presents, then hangs up before naming a sender or a recipient. It tries the first six servers, one connection each to its first IPv4 address. It also reads the domain’s MTA-STS policy (fetched over HTTPS), its TLS reporting address and any DANE records, and checks each server’s IPv4 address against six free blocklists.
Check it after switching email provider, when messages to a domain bounce, or before changing DNS settings, so you have a note of the current setup. It’s also a quick way to see which service handles a company’s email.
How to use the MX record lookup
- Type a domain, or an email address: we use the part after the @.
- Press Look up. Mail servers are listed in the order senders try them, each with its addresses and what happened on port 25.
- Follow the steps under What to do if anything is flagged, then check SPF, DMARC and DKIM for the same domain.
Understanding the results
The headline says whether the domain is ready to receive email and how many mail servers it lists. When the names match a well-known email service, we name it; that guess is based only on the server names. Servers that share a priority number share the load. Higher numbers are backups, which senders try only when the lower ones don’t answer.
A server is flagged when its name doesn’t resolve, resolves only to a private address, or doesn’t answer on port 25, because other servers can’t deliver to it. A certificate that is self-signed, expired or made out to another name is a warning: most senders still deliver over it, but any that enforce MTA-STS or DANE won’t. MTA-STS in enforce mode tells senders to insist on a valid certificate, and TLS-RPT is where they report failures. If our server can’t reach port 25 on any of them, the result says so and is judged from DNS alone: many networks block port 25, so that says nothing about the domain.
Without MX records, the summary tells you whether the domain publishes a null MX, doesn’t exist at all (NXDOMAIN), or has no mail servers. In that last case senders fall back to the domain’s own address, so we try that address on port 25 too. If you’ve just changed provider and still see the old servers, compare our resolver’s copy with the answer from the domain’s own name server; the TTL shows how long a cached copy can last.
Questions
What does priority mean?
Senders try the lowest number first and fall back to higher numbers if it doesn’t answer. Equal numbers share the load.
What is a null MX?
A record with priority 0 and the host “.” says the domain accepts no email at all. It’s a good choice for domains that never receive mail.
Do you send a test email?
No. We connect, read the greeting, say hello with EHLO, ask for STARTTLS and read the certificate, then hang up before naming a sender or a recipient, so no message is sent and no mailbox is checked.
Do MX records control outgoing email?
No. They only decide where incoming mail is delivered. The servers allowed to send mail for your domain are listed in its SPF record, which the SPF and DMARC checker reviews.
Why are the places approximate?
We show where DB-IP places each address’s network (IP location by DB-IP), at city level at most. Large providers answer from many data centres, so a mail server can be somewhere else.
Why is only one address per server tried?
We connect to each server’s first IPv4 address, as most senders do, and to the first six servers when a domain lists more. Its IPv6 addresses are listed with their reverse DNS, but not connected to.
Why couldn’t you test port 25?
Some networks block outgoing connections on port 25. When none of the mail servers answers our server in time, we say so instead of guessing: it says nothing about the domain, and the rest of the result still comes from DNS.
Which blocklists do you check?
Six free blocklists: SpamCop, UCEPROTECT L1, PSBL, Mailspike, DroneBL and S5H. We check each mail server’s public IPv4 addresses; the lists cover IPv4 only. A listing matters when the same server also sends mail. To be removed from a list, follow that list’s own instructions.
Are lookups stored?
Recent lookups stay in your browser. A PDF report keeps a copy so anyone with its reference can verify it.