How to identify suspicious MX records and what tools to use for checking them?
Matthew Whittaker
Co-founder & CTO, Suped
Published 22 Jul 2025
Updated 19 Aug 2025
7 min read
Mail Exchanger (MX) records are a foundational element of how email systems work. They tell the internet which mail servers are responsible for accepting email messages on behalf of a domain. Essentially, without correctly configured MX records, your emails simply wouldn't know where to go, meaning they wouldn't be delivered to your inbox.
However, like many critical infrastructure components, MX records can be exploited. Malicious actors sometimes manipulate or hijack MX records to redirect emails, intercept sensitive information, or launch spam and phishing campaigns. Understanding how to identify suspicious MX records is therefore crucial for maintaining email security and ensuring reliable deliverability.
What are MX records and why do they matter?
An MX record is a type of DNS (Domain Name System) record that specifies a mail server responsible for accepting email messages on behalf of a domain name. It also defines a preference value, which indicates the order in which multiple mail servers should be tried. A lower preference value means a higher priority.
When you send an email, the sending server performs a DNS lookup to find the recipient's MX records. It then attempts to connect to the mail server with the lowest preference number. If that server is unavailable, it tries the next one in the list. This ensures that emails can still be delivered even if a primary server is down.
Correctly configured MX records are vital for email deliverability. Without them, your domain's emails may bounce, be sent to spam, or fail to reach their intended recipients altogether. They are a fundamental part of the email authentication process, working alongside SPF and DKIM to ensure emails are legitimate.
Example MX records
yourdomain.com. IN MX 10 mail.yourdomain.com.
yourdomain.com. IN MX 20 backup.yourdomain.com.
Identifying red flags in MX records
Identifying suspicious MX records often comes down to recognizing deviations from what's expected for a legitimate email setup. While experience plays a significant role, there are specific patterns and indicators that can signal something is amiss.
One common red flag is an MX record pointing to an unfamiliar or generic-looking domain, especially if it's not associated with a reputable email service provider. For instance, if a company typically uses Google Workspace or Microsoft 365, but their MX records point to a seemingly random or unbranded server, that's a cause for concern. Attackers might use these to intercept emails in a man-in-the-middle attack (MITM), redirecting incoming messages to their own servers.
Another indicator is the complete absence of MX records for a domain that should be receiving email, or if they timeout when queried. While a timeout doesn't definitively mean non-existent records, it suggests that mail delivery would fail. This might be an oversight, but it could also indicate a misconfiguration that could be exploited by an attacker, or that the domain is not intended to receive mail, such as in the case of a spamtrap domain.
Beyond that, unusually high or low preference values, or a sudden change in an MX record without prior knowledge, can also be suspicious. It's also worth noting unusual SPF and MX records that could signal a problem. These often hint at misconfigurations or, in worst-case scenarios, a malicious takeover where the attacker tries to ensure their fraudulent mail server is prioritized.
Suspicious MX record patterns
Unfamiliar domains: The MX record points to a mail server that doesn't belong to the expected email provider.
No MX records: A domain that should receive email has no MX records, leading to delivery failures.
Unexpected IPs: An MX record resolves to an IP address that is known for spam or is on a blacklist (or blocklist).
Priority manipulation: A suspicious server has the lowest (highest priority) preference value, ensuring it receives mail first.
DNS timeouts: Queries to the MX record time out, preventing mail delivery.
Tools to check your MX records
To check MX records, you have several options, ranging from command-line tools built into your operating system to convenient online services. Each has its advantages.
Command-line tools
For Windows users, nslookup is the default DNS query tool. You can open Command Prompt and type nslookup -type=mx yourdomain.com. However, nslookup has some known limitations and can sometimes provide misleading diagnostics. For Linux and macOS, the dig command is generally preferred due to its more detailed output. You would use dig MX yourdomain.com.
Online lookup tools
For a quick and easy check, numerous online MX lookup tools are available. These tools typically require you to simply enter the domain name, and they will display the associated MX records, along with their preference values and sometimes even the resolved IP addresses. Popular options include the DNS Checker MX Lookup, MXToolbox, and Google Admin Toolbox Check MX tool. These are often helpful for a rapid assessment and to verify that your bulk list of MX records are correct.
When using these tools, pay attention not just to the domain names in the MX records but also to their priority values. A legitimate setup typically lists the primary mail server with the lowest preference number, and backup servers with higher numbers. Any unexpected entry, especially with a low preference value, warrants further investigation.
Feature
Command-line tools (dig/nslookup)
Online MX lookup tools
Ease of use
Requires basic command-line knowledge; nslookup can be misleading.
User-friendly interface, simply enter domain.
Access
Pre-installed on most OS (or easy to install).
Web-based, accessible from any browser.
Detail level
Can provide raw DNS responses, including TTL and other record types.
Presents formatted, easy-to-read MX record details.
Advanced checks
More flexible for complex queries or scripting.
Often includes integrated checks for SPF, DKIM, DMARC, and IP blocklists.
Proactive monitoring and broader implications
Checking MX records is a fundamental step, but it's part of a larger ecosystem of email deliverability and security. To truly ensure your email flow is secure and reliable, you need to integrate MX record checks into a broader monitoring strategy.
Automated monitoring solutions can help track changes to your DNS records, including MX records, and alert you to any unauthorized modifications. This proactive approach is key to detecting and mitigating threats (like MX hijacking or misconfigurations) before they impact your email communications or lead to compromised data.
Secure MX record management
Consistent provider: MX records consistently point to your chosen, trusted email service.
Proper priority: Preference values are logically ordered, with primary servers having the lowest numbers.
Regular audits: Periodic checks for any unauthorized changes or misconfigurations.
Insecure MX record management
Unfamiliar targets: MX records point to unknown or suspicious mail servers, potentially controlled by attackers.
Incorrect priority: Malicious servers are given high priority to intercept email traffic.
Lack of monitoring: Changes go unnoticed, leaving the domain vulnerable to email interception or abuse.
Views from the trenches
Best practices
Always verify MX records against your expected email service provider's documentation. Ensure the hostnames and preference values match.
Implement DNS monitoring tools that alert you to any unauthorized changes to your domain's DNS records, including MX records.
Regularly audit your entire DNS configuration to catch any discrepancies that could compromise email flow or security.
Ensure your DMARC, SPF, and DKIM records align with your MX records to strengthen email authentication and prevent spoofing.
Common pitfalls
Relying solely on one tool or method to check MX records; use a combination for comprehensive verification.
Ignoring unexpected MX records, even if they have a low preference value, as they could still be part of a malicious setup.
Not understanding the difference between a DNS timeout and a truly non-existent MX record, which requires further diagnosis.
Failing to connect MX record health with overall email deliverability and sender reputation, leading to overlooked issues.
Expert tips
Use dig for more accurate diagnostics than nslookup, especially on non-Windows systems.
A timeout doesn't necessarily mean MX records are non-existent, but it does mean mail won't be delivered.
Look for MX records that don't belong to your known email providers, as this is a key sign of compromise.
Consider how MX record issues can lead to blacklisting or impact email deliverability.
Marketer view
Marketer from Email Geeks says that knowing how to identify the correct provider and what that implies is critical when looking at MX records, beyond just the presence or absence of a record.
2019-09-19 - Email Geeks
Marketer view
Marketer from Email Geeks says that nslookup has long-standing issues, and its diagnostic output can sometimes be misleading, so it's often better to use alternative tools.
2019-09-19 - Email Geeks
Maintaining email flow
Identifying suspicious MX records is a critical practice for maintaining email security and ensuring reliable message delivery. While it might seem complex at first, understanding the common red flags and leveraging the right tools makes the process manageable.
By regularly checking your MX records using command-line tools like dig or reputable online services, and integrating these checks into a broader email authentication strategy, you can protect your domain from potential threats and ensure your emails always reach their intended recipients.
Google Workspace or 
Microsoft 365, but their MX records point to a seemingly random or unbranded server, that's a cause for concern. Attackers might use these to intercept emails in a man-in-the-middle attack (MITM), redirecting incoming messages to their own servers.
