MX LookupDNS Tools
Mail servers from MX records, with priority and the host's addresses.
How to find MX records for a domain and check its SPF and DMARC
Mail stopped arriving after a host move, or a new provider asks you to confirm your DNS. Read the MX records first, then the SPF and DMARC records that tell other servers which mail to trust.
Where a domain's email settings live in DNS
Email for a domain depends on several DNS records kept in different places. MX records name the servers that receive mail, each with a priority number, and 10 is tried before 20. SPF is a TXT record on the domain that starts with v=spf1 and lists the hosts allowed to send for it. DMARC is also a TXT record, but it lives at _dmarc plus your domain, not at the bare domain. DKIM sits under a selector the mail system chooses, such as selector._domainkey.example.com.
When one of these is missing or still points at an old provider, mail can bounce or land in spam. One case looks like an error and isn't: a single dot as the MX host, at priority 0, is a null MX, which says the domain accepts no mail at all.
Read the mail servers, the policies, then the sender's name
Enter the domain in the MX Lookup. It lists the mail servers in priority order, then looks up the A and AAAA addresses of each mail host with the same resolver, so you can see where every name points. Asking ns1.google.com about google.com returned one server, smtp.google.com, at priority 10 with a TTL of 300. The tool doesn't open port 25 or send a test message.
Next, read the policies in the TXT Record Lookup. It joins TXT chunks into one readable string, labels strings that start with v=spf1 as SPF, and makes a second query for _dmarc plus your domain, where DMARC lives. google.com's SPF record, for example, is v=spf1 include:_spf.google.com ~all. Site-verification tokens get their own label, so you can tell them apart from mail policy. The page shows each policy as published. It doesn't judge whether it is safe, and it doesn't try DKIM selectors on its own.
If you run your own sending server, put its IP address into the Reverse DNS Lookup. It reads the PTR name for the address and checks whether that name resolves back to the same address. Mail servers often require this round trip before they accept mail from an IP. You can't change the PTR here. Whoever owns the address sets it with their network provider.
Check the mail DNS records for a domain
- Enter the domain in the MX Lookup, tick the robot check, and press Look up.
- Confirm the mail hosts belong to your current provider and note which one has the lowest priority number.
- Enter the domain in the TXT Record Lookup and find the rows labeled SPF and DMARC.
- Check that the SPF record includes your mail provider and that a DMARC record exists.
- For your own sending server, look up its IP in the Reverse DNS Lookup and confirm the name points back to it.
What these lookups don't test
- None of the tools sends a test message or opens port 25.
- The TXT lookup shows SPF and DMARC as published. It doesn't grade them.
- DKIM selectors are not guessed. You need the selector name from your mail system.
- PTR records can't be edited here, and private and loopback addresses are refused.
Frequently asked questions
Which MX record is used first?
The one with the smaller priority number. Priority 10 is tried before priority 20, and equal numbers can be used together.
Where is the SPF record for my domain?
SPF is a TXT record on the domain that starts with v=spf1. It isn't part of the MX records.
Why is DMARC on a different name?
The DMARC spec puts the policy at _dmarc.example.com, not at the bare domain.
What does ~all mean at the end of an SPF record?
It is a soft fail for hosts the record didn't list. -all tells receiving servers to reject mail from those hosts.
Related tools
Tools used in this guide
TXT Record LookupDNS Tools
TXT strings for a domain, with SPF and DMARC labeled, including the _dmarc name.
Reverse DNS LookupDNS Tools
PTR name for an IP address, plus a forward check that the name resolves back.
