Glossary
DNS MX record
An MX record names a server that accepts email for a domain, together with a preference number. A sending mail server looks up the MX records for the recipient's domain, sorts them by preference — lowest number first — and tries them in that order. A domain with no MX records either does not receive mail at all or falls back to its address records, which is almost never what the operator intended.
How preference works
Each MX record carries a 16-bit preference value. Lower is more preferred, which reads backwards to most people the first time.
Two records with the same preference are equivalent, and senders distribute between them. That is how a pair of equal-capacity inbound servers is expressed.
Records with different preferences form a fallback order: the higher-numbered server is tried only when the lower-numbered ones cannot be reached.
A backup server that accepts mail and cannot deliver it onward is worse than no backup, because the sender considers the message delivered and stops retrying.
What the target must be
An MX record must point at a hostname that resolves to an address. Pointing it at an IP address directly is invalid, and pointing it at a CNAME is prohibited by the specification even though some implementations tolerate it.
The target hostname should resolve over both IPv4 and IPv6 if the service supports both, and both should accept connections on the SMTP port.
A target that no longer resolves is a silent failure: mail bounces at the sending side, and nothing on the receiving domain records that it happened.
The reverse DNS of the outbound server is a separate matter, checked by receiving systems for outbound mail rather than inbound.
Redundancy, and what it is worth
A single MX record is a single point of failure for inbound mail. Senders retry for a period — typically a few days — so a short outage loses nothing, but the messages queue elsewhere.
Two or more targets on independent infrastructure remove that. Hosted mail providers publish several by default, which is one of the practical reasons to use one.
Two records pointing at the same machine provide no redundancy at all, and it is a configuration seen often enough to be worth checking explicitly.
Redundancy does not protect against a domain-level problem: an expired domain, a broken delegation or a DNSSEC failure takes every MX record with it.
How to check a domain's mail routing
`dig example.com MX +short` lists the preference and target of each record.
Resolve each target with `dig <target> A` and `dig <target> AAAA` to confirm it still has an address. A target pointing nowhere is the most common quiet failure.
Check that the targets belong to the provider you believe is handling your mail. A leftover record from a previous provider silently receives a share of the traffic.
MX records establish where mail arrives. Whether your domain can be forged by others is a separate question answered by SPF, DKIM and DMARC.
Frequently asked questions
- Does a lower preference number mean higher priority?
- Yes. Senders try the lowest preference value first. Equal values are treated as equivalent and traffic is spread between them.
- Can an MX record point at an IP address?
- No. The target must be a hostname that resolves to an address, and it must not be a CNAME.
- What happens if a domain has no MX record?
- Senders may fall back to the domain's address records, which usually point at a web server that does not accept mail. In practice the mail is lost or bounces.
Sources
Related
VeriFixScan crawls a site and applies its checks to every page it reaches, keeping the evidence behind each finding. Scanning one website is free.
Scan a website