An MX (Mail Exchanger) lookup retrieves the mail server records for a domain - showing which servers accept incoming email for that domain and at what priority. Email routing, spam filtering, deliverability troubleshooting, and phishing investigations all start by asking "where is email for this domain actually being sent?". MX records are among the most security-sensitive DNS records: an attacker who changes a domain's MX records can intercept password resets, banking notifications, and internal communications without users noticing.
Feature: Live MX records from authoritative nameservers, sorted by priority (lowest priority = primary mail server)
Feature: Each MX hostname resolved to its current IP addresses for full mail-server validation
Feature: Cross-reference with TXT (SPF) records via DNS Lookup to verify authorized sending infrastructure matches actual mail servers
Feature: Free tool covers individual lookups; bulk MX checks across thousands of domains available through the API
For continuous email-infrastructure monitoring, deliverability auditing across portfolios, and phishing-detection automation, the DNS Checker API for email infrastructure monitoring returns parsed MX data in JSON for high-volume queries.
MX records sit at the centre of every email-related task: deliverability troubleshooting, anti-phishing monitoring, SPF policy verification, and phishing-domain investigation. The four use cases below are where MX Lookup gets the most use.
When email to or from a domain fails or bounces unexpectedly, MX Lookup is the first diagnostic step. It confirms whether MX records exist, whether the mail server hostnames resolve to valid IPs (cross-reference with the DNS Lookup), and whether priority values are configured correctly for your primary and backup mail servers.
Attackers who gain control of a domain's DNS (via registrar compromise or DNS hijacking) often change MX records to intercept incoming email - including password resets, banking notifications, and internal communications. Security teams should monitor MX records for all critical domains and alert on any change. For historical MX configurations, use the Historical DNS Lookup - MX record history is one of its most queried features.
SPF records authorize which mail servers may send email on behalf of a domain. The 'mx' mechanism in an SPF record automatically authorizes all servers listed in the domain's MX records. MX Lookup lets you see exactly which servers are being authorized via the SPF 'mx' mechanism - critical for ensuring your SPF policy matches your actual sending infrastructure. Check both MX and TXT (SPF) records together via the DNS Lookup.
Phishing domains frequently configure MX records to collect credentials submitted via fake login forms. Checking MX records on suspected phishing domains reveals if they're set up to receive email - a common signal that the domain is being actively operated for malicious purposes rather than just parked.
WhoisFreaks queries authoritative nameservers directly for accurate, current MX records, returning all mail-server hostnames sorted by priority. Each MX hostname is automatically resolved to its IP addresses, so you see the full mail-routing picture without running a separate A-record lookup.
A domain with no MX records will fall back to the A record for email routing, or reject delivery entirely. Always verify both MX and A records when troubleshooting email delivery - use the DNS Lookup to check both record types in a single query.
