DNS MX Record (Mail Exchanger)
Detailed technical specification, security configuration analysis, threat modeling, and defensive whitelists.
Asset Risk Analysis Context
DNS records govern critical mapping parameters. Stale or misconfigured records are swept continuously by external threat monitors and passive asset enumerators.
Scan Your DNS Zone NowWhat is a DNS MX Record?
The Mail Exchanger (MX) record specifies the mail servers responsible for accepting incoming email messages on behalf of a domain name. It includes a preference value, telling sender systems which mail server to try first when delivering messages.
MX Preference and Mail Routing
An MX record contains:
1. Mail Server Hostname: The domain name of the mail server (e.g., mail.example.com).
2. Priority/Preference: A numeric value where lower numbers indicate higher priority. The sending server will attempt delivery to the server with the lowest preference value first.
Threat Models Involving MX Records
MX records are primary targets for phishing and interception:
- Backup Mail Server Exploits: Attackers often look for backup MX servers (higher preference numbers) that have weaker spam filtering than the primary mail server. They send spam directly to the backup server to bypass defenses.
- MX Hijacking: If an attacker gains access to the DNS zone file, they can alter the MX record to route all incoming corporate email to an attacker-controlled server, harvesting sensitive attachments and login links.
- Email Spoofing Verification: MX records must align with SPF records. If SPF records are misconfigured, attackers can spoof incoming mail by sending from unauthorized relays.
Recommendations for Mail Security
- Filter Backup MX Servers: Apply identical spam filtering and validation rules to all mail servers listed in your MX records, regardless of their preference level.
- Enforce TLS on Mail Servers: Ensure mail servers support MTA-STS (Mail Transfer Agent Strict Transport Security) to force secure TLS encryption on all incoming connections.
- Audit MX Zone Entanglements: Never point an MX record to a CNAME alias; industry RFC standards require MX records to point directly to an A or AAAA host record.
Frequently Asked Questions
What is the purpose of an MX record?
It tells the internet which mail servers are authorized to receive incoming emails for your domain.
Can I have multiple MX records?
Yes. Multiple MX records provide redundancy and failover, routing mail to secondary servers if the primary goes offline.
What does the priority number mean in an MX record?
It dictates the order in which sending servers try to deliver email. The server with the lowest preference number is contacted first.
Can an MX record point to an IP address?
No. MX records must point to a domain name (hostname), which then resolves to an IP via an A or AAAA record.
How do MX records interact with SPF?
SPF records reference your MX records (using the 'mx' mechanism) to verify if the sending IP is authorized to send email.