How MX records work (and why we check them)
MX records tell the world which servers accept mail for a domain. Checking them is the first real test of whether an address can receive email.
Photo by Schäferle on Pixabay
When you send an email to sam@example.com, your mail server needs to know where to deliver it. It finds out by asking the Domain Name System (DNS) for the domain's MX records.
What an MX record is
MX stands for Mail Exchanger. A domain publishes one or more MX records, each naming a mail server and a priority number:
example.com. MX 10 mx1.mailhost.com.
example.com. MX 20 mx2.mailhost.com.
Lower numbers are tried first. If the first server is down, the sender falls back to the next. That is how large domains stay reachable.
What happens with no MX record
If a domain has no MX records, the standard says mail should fall back to the domain's address records (A or AAAA) and try delivering to the domain itself. In practice most domains that receive mail publish proper MX records, so a missing MX is a strong hint that something is off. Mailsure performs the same fallback before giving a verdict.
Null MX
A domain that never wants mail can say so explicitly with a null MX, a single record with priority 0 and a dot as the target. Sending to it is pointless, and a verifier should mark such an address invalid.
What an MX check tells you
- Domain doesn't exist (
NXDOMAIN): invalid. Typically a typo or a lapsed domain. - Domain exists, no mail servers: invalid, it can't receive mail.
- Domain has MX records: it can receive mail. This doesn't prove the mailbox exists, only that the domain accepts mail.
A note on DNS errors
DNS can fail for reasons that have nothing to do with the address: a timeout, a flaky resolver, a temporary outage. A careful verifier treats these as unknown, not invalid, because condemning a good address over a network blip would delete real customers. If you get an unknown, try again later.
What MX also reveals
The names in MX records show which provider hosts the mail. aspmx.l.google.com means Google Workspace, *.mail.protection.outlook.com means Microsoft 365. That is how a verifier identifies the provider, which matters because large providers behave differently (why Gmail and Outlook are hard to verify).
Checking MX is cheap, fast and removes a large share of bad addresses by itself. It is the first test every address should pass.
