Direct answer
MX records indicate mail-routing destinations for a domain. Compare the observed records and priorities with the organization's approved configuration; an MX hostname alone does not prove who operates every mailbox or that mail is delivered safely.
Record the observed configuration
For each authorized domain, record the MX answer, priority, query time and resolver context. A lower numerical priority is generally preferred by mail senders, while multiple destinations can be used for resilience. Ask the mail owner what configuration is intended.
Reference: RFC 5321: Simple Mail Transfer Protocol.
Reconcile with the provider inventory
A third-party filtering or hosting service can be a legitimate part of the mail path. Compare the observed destination with the organization's contracts and administrative records before interpreting a provider name as suspicious.
Reference: RFC 1034: Domain names: concepts and facilities.
Verify a planned change
Coordinate DNS changes with the mail team, document rollback and test controlled delivery after the change. Include inbound delivery, any filtering service and an approved test recipient. Allow for DNS caching and record when each result was observed.
- Record the expected domain and priority values.
- Do not send unsolicited test messages to unrelated recipients.
- Escalate inconsistent results to the responsible owner.
Keep the conclusion narrow
MX describes routing, not SPF, DKIM or DMARC correctness and not whether a particular message is genuine. Review authentication separately and verify business requests independently. An absence of one result from one resolver does not establish the domain has no mail service.
Assessment limits
DNS answers are time-bound and can vary with resolver and cache. Routing records cannot prove mailbox ownership, message authenticity or end-to-end delivery.
Frequently asked questions
Does an MX record identify every mailbox?
No. It identifies mail-routing destinations for a domain, not individual mailbox owners.
Does a familiar mail provider prove an email is safe?
No. Routing and provider identity do not establish the legitimacy of a particular message.
Primary sources and further reading
These guides combine published security guidance with practical assessment planning. Adapt checks to the owner's policy, environment, and authorized scope.
This guide was prepared with AI assistance using the linked sources and illustrative examples. Check current vendor guidance and your environment before making changes.