Cybersecurity glossary
What is an MX Record?
Learn what an MX record is, how mail exchangers and preference values route email, and why MX planning should align with SPF and modern email security controls.
Definition
An MX record is a DNS resource record that tells sending mail servers which hostnames accept email for a domain and in what preference order they should be tried.
Why mail depends on MX records
Web traffic often starts with a browser and a URL. Email delivery starts with a domain and a DNS lookup for MX records. Before one mail server can hand a message to another, it needs to know which systems are supposed to accept mail for the recipient domain.
That is why MX data is both operationally important and easy to overlook. A perfectly healthy mail platform can still appear broken if the published routing records are incomplete, misordered, or left behind after a provider change.
What an MX answer contains
MX records do two jobs at once: they identify the receiving hostnames and rank them by preference. They do not include the final IP addresses directly.
Owner domain
The domain receiving mail, such as example.com, publishes one or more MX records in its zone.
Preference value
A lower number is tried before a higher one, allowing primary and backup delivery paths.
Exchange hostname
Each MX entry points to a hostname like mx1.mail-provider.net rather than to a raw IP address.
Address dependency
The exchange hostname must itself resolve through A or AAAA records so SMTP clients can open a connection.
How a sending server uses MX records
Extract the recipient domain
The sending system looks at the address after the @ sign, such as example.com.
Query DNS for MX
The mail transfer agent asks DNS which mail exchangers handle that domain.
Sort by preference
The sender orders the returned exchanges from lowest preference number to highest.
Resolve the chosen exchanger
The selected MX target hostname is resolved to one or more IP addresses using A or AAAA lookups.
Attempt SMTP delivery
The sender connects to the target host and tries to transfer the message using SMTP.
Fail over if needed
If the preferred exchanger is unavailable, the sender can try another published MX target.
Mail-routing patterns teams should recognize
| Pattern | Example | Operational meaning |
|---|---|---|
| Primary plus backup MX | 10 mx1.provider.net, 20 mx2.provider.net | Mail is attempted against the lower-preference target first, with a secondary path available if it fails. |
| Single hosted provider | 10 aspmx.example-mail.net | Common for SaaS mail; DNS still becomes a single point of routing truth. |
| Null MX | 0 . | The domain explicitly does not accept email, reducing pointless delivery attempts. |
| Stale provider migration | Old MX hostnames remain after a platform cutover. | Delivery can be delayed, split, or exposed if old targets are no longer controlled. |
Security notes: MX is routing, SPF is policy
MX records tell senders where to deliver mail. They do not say who is allowed to send mail for the domain. That second question is where sender-side controls such as SPF, along with DKIM and DMARC, matter.
The practical connection is operational: if you migrate mail providers, you often have to update both routing and security policy at the same time. Forgetting the MX record breaks delivery. Forgetting SPF can break trust decisions even when delivery still works.
- Publish explicit MX records for domains that receive mail instead of depending on ambiguous fallback behavior.
- Use a null MX for domains that should never receive email, such as certain web-only brands or parked domains.
- Ensure every MX target hostname resolves correctly over A and/or AAAA before cutover.
- Align mail-provider changes with SPF, DKIM, and DMARC updates so routing and authentication stay consistent.
- Review old MX targets after migrations to confirm that you still control every provider hostname you publish.
- Monitor SMTP delivery failures alongside DNS changes because mail incidents often begin as record drift.
- Prefer at least two tested delivery paths when business continuity requirements justify it.
- Document which team owns inbound mail routing so DNS edits are not made without mail-platform validation.
Small DNS mistakes create large email symptoms
End users usually experience MX problems as bounced messages, delayed delivery, or silent non-delivery. The root cause, however, may be one missing record, one incorrect preference, or one forgotten legacy provider entry.
Because email is asynchronous, DNS-induced failure can also be confusing to debug. Messages may queue, retry later, and partially succeed depending on which sender and which MX target was attempted.
The practical takeaway
An MX record is the DNS instruction set that tells other mail servers where your domain receives email and which destination they should try first.
Treat MX data as production routing infrastructure. Keep the targets resolvable, keep priorities intentional, and update adjacent controls such as SPF whenever mail handling changes.
Related security terms
NS Record
Authoritative name servers publish the MX data that sending systems rely on.
A Record
MX targets ultimately need address records so mail transfer agents can connect to them.
DNS Zone
MX records live inside the zone data for the domain receiving email.
Dangling DNS Record
Old MX targets can become risky when a mail provider migration leaves abandoned hostnames behind.
Domain Name System (DNS)
DNS provides the routing metadata that mail servers query before delivery.
Frequently asked questions
What is an MX record in simple terms?
It tells the Internet which mail servers should receive email for a domain, such as example.com.
What does MX priority mean?
The preference number indicates the order in which sending servers should try the listed mail exchangers. Lower numbers are preferred first.
Can an MX record point directly to an IP address?
No. MX records point to hostnames, and those hostnames then need A or AAAA records.
What happens if a domain has no MX record?
Some senders may fall back to the domain's address records, but reliable mail operation usually expects explicit MX records or a null MX if the domain accepts no email.
What is a null MX record?
A null MX, defined in RFC 7505, clearly signals that a domain does not receive email and helps prevent unnecessary delivery attempts.
Does SPF replace MX records?
No. MX records route incoming mail. SPF helps receiving systems evaluate whether a sending host is authorized to send on behalf of a domain.
Why do mail outages often involve DNS?
Because sending servers cannot deliver mail correctly if the MX answers are missing, wrong, stale, or point to targets that no longer resolve.
References
Explore authoritative guidance and frameworks related to mx record.
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.