An MX lookup queries a domain's authoritative nameservers and returns its MX (Mail Exchanger) records: the hostnames that accept incoming email for that domain, each with a priority number. Lower numbers are tried first. Checking MX records is the first step in diagnosing email delivery, verifying an SPF policy, or investigating a phishing domain.
MX records are among the most security-sensitive DNS records. An attacker who changes a domain's MX records can intercept password resets, banking notifications, and internal communications without users noticing.
Feature: Live MX records from authoritative nameservers, sorted by priority (lowest priority = primary mail server)
Feature: Each MX hostname resolved to its current IP addresses for full mail-server validation
Feature: Cross-reference with TXT (SPF) records via DNS Lookup to verify authorized sending infrastructure matches actual mail servers
Feature: Free tool checks one domain per query; bulk MX checks across an entire domain list run through the DNS API
The DNS Checker API returns the same MX data as JSON, so you can watch mail-server changes across a domain list or feed MX checks into a phishing-detection pipeline.
MX records get checked for four reasons: an email is not arriving, an SPF policy needs verifying, a mail server has changed, or a suspicious domain needs investigating.
When email to or from a domain fails or bounces unexpectedly, MX Lookup is the first diagnostic step. It confirms whether MX records exist, whether the mail server hostnames resolve to valid IPs (cross-reference with the DNS Lookup), and whether priority values are configured correctly for your primary and backup mail servers.
Attackers who gain control of a domain's DNS (via registrar compromise or DNS hijacking) often change MX records to intercept incoming email - including password resets, banking notifications, and internal communications. Security teams should monitor MX records for all critical domains and alert on any change. For historical MX configurations, use the Historical DNS Lookup - MX record history is one of its most queried features.
SPF (Sender Policy Framework) records authorize which mail servers may send email on behalf of a domain. The 'mx' mechanism in an SPF record automatically authorizes all servers listed in the domain's MX records. MX Lookup lets you see exactly which servers are being authorized via the SPF 'mx' mechanism - critical for ensuring your SPF policy matches your actual sending infrastructure. Check both MX and TXT (SPF) records together via the DNS Lookup.
Phishing domains frequently configure MX records to collect credentials submitted via fake login forms. Checking MX records on suspected phishing domains reveals if they're set up to receive email - a common signal that the domain is being actively operated for malicious purposes rather than just parked.
WhoisFreaks MX Lookup queries a domain's authoritative nameservers directly and returns every mail-server hostname sorted by priority. WhoisFreaks also resolves each MX hostname to its current IP addresses, so the full mail-routing path is visible without a separate A-record lookup.
A domain with no MX records will fall back to the A record for email routing, or reject delivery entirely. Always verify both MX and A records when troubleshooting email delivery - use the DNS Lookup to check both record types in a single query.
