MX Record Lookup
Mail exchangers for a domain in priority order, each resolved, plus the SPF and DMARC records that decide whether somebody else can send mail as you.
This tool needs JavaScript: DNS queries happen on the server, because a browser cannot make one.
The domain part of an address. A whole email address or a URL works too: everything before the @ and after the host is removed.
This is one of the few tools here that asks the server rather than your browser, because a browser cannot do it. Nothing you put in is stored; the request is rate limited by address and the answer is not cached.
Where mail for a domain goes, in the order servers try, plus the two records that decide whether somebody else can send mail pretending to be you. Both of those are usually the real question: MX records are rarely wrong, and SPF and DMARC are missing far more often than anybody expects.
How to use
Put in a domain. A whole email address works, and so does a URL: everything before the @ and after the
host is removed.
Example
Domain wordpress.org
Mail exchangers, by priority
10 mx1.wordpress.org 198.51.100.10
20 mx2.wordpress.org 198.51.100.11
Can somebody else send mail as this domain?
SPF v=spf1 include:_spf.example.net -all
SPF ending hard fail, which is the strict setting
DMARC v=DMARC1; p=reject; rua=mailto:[email protected]
DMARC policy spoofed mail is refused, which is the end state to aim forPriority is lowest-first, and the numbers only matter relative to each other: 10 and 20 behave exactly like 1 and 2.
Pitfalls
No SPF record means anybody can claim to be you. Without one, a receiving server has nothing to check the sending server against, and mail claiming to come from your domain arrives looking legitimate.
~all is not -all. A soft fail asks receivers to accept the message and mark it; a hard fail asks
them to reject it. Ending with +all or ?all is the same as having no record at all, and it happens
when somebody copies an example.
SPF has a ten-lookup limit. Every include: costs a DNS lookup, and once the chain goes past ten the
record is invalid and the whole thing fails. It is the commonest way an SPF record silently stops working
after the fourth service is added.
DMARC at p=none does nothing but report. It is the right place to start and the wrong place to
stay: spoofed mail still arrives. The path is none, then quarantine, then reject, watching the reports
between each step.
SPF alone does not survive forwarding. A forwarded message arrives from the forwarder’s server, which is not in your SPF record. DKIM survives forwarding, which is why DMARC accepts either.
An MX record must point at a hostname, never at an address. A record whose target is an IP is invalid and some receivers refuse it outright.
A domain with no MX records can still receive mail at some receivers, which fall back to the A record. Relying on that is a bad idea, and most modern senders do not.
Changes take as long as the TTL says. A lookup here is one server’s current answer; other resolvers keep the old one until their copy expires.
Compatibility
This is one of the few tools on the site that asks the server, because a browser cannot make a DNS query. The lookup uses the server’s own resolver, so what you see is what that resolver currently holds: another network can legitimately see something different while a change propagates.
The domain is checked before anything is looked up. Names that only exist inside a network — localhost,
anything ending .local, .internal, .home.arpa, .test — are refused, and so is a name that resolves
only to private or reserved addresses. That check exists because a server-side lookup tool is an invitation
to ask the server about things on its own network.
The endpoint is rate limited to 20 lookups a minute per address, the counter is keyed by a salted hash of the address rather than the address itself, and the response is not cached. Nothing about the lookup is stored.
Each MX target is resolved as well, so a record pointing at a host that no longer exists shows as “does not resolve” rather than looking fine.
Frequently asked questions
Why do I see different records from another checker?
What should my SPF record look like?
v=spf1, listing the services that send on your behalf, ending in -all once you
are confident the list is complete. One record only: two SPF records make both invalid.Do I need DKIM as well?
My mail goes to spam. Is this the cause?
Can I check a subdomain?
mail.example.com follows that subdomain’s own records, and DMARC for a subdomain falls
back to the organisational domain’s policy unless the record sets sp=.