Reverse MX Lookup

Article Summary: This article explains what MX records are, how mail exchanger priority works, and what reverse MX lookup reveals about email hosting relationships across domains. It covers practical applications from competitive intelligence to email security auditing, and includes a reference table of major mail providers and their MX hostnames.

What Is Reverse MX Lookup?

An MX record (Mail Exchanger record) tells the DNS system which servers should receive inbound email for a domain. When someone sends an email to [email protected], the sending mail server looks up the MX record for example.com and delivers the message to the hostname specified there. A standard MX lookup takes a domain and returns its mail servers. A Reverse MX Lookup takes a mail server hostname and returns all domains whose MX record points to it.

Like the reverse NS lookup, this is not a native DNS query type. It requires a curated database of observed MX records built by recording the mail exchanger data encountered during DNS queries across the platform. Each time a domain's DNS records are retrieved through IpDnsHub, the MX records are indexed by their hostname, creating a reverse mapping that grows richer with every new domain query.

How It Works

MX Record Structure and Priority

Every MX record consists of two components: a priority value (a non-negative integer) and a mail exchanger hostname. The priority value determines preference when multiple MX records exist — a lower number means higher priority. The sending server will always attempt to deliver to the lowest-numbered MX host first, falling back to higher-numbered hosts only if the primary is unavailable. For example, Google Workspace typically configures five MX records for a domain, ranging from priority 1 (aspmx.l.google.com) to priority 10 (alt4.aspmx.l.google.com), providing five levels of redundancy.

Shared Mail Server Hosting

The vast majority of domains do not operate their own mail servers. Instead, they use managed email hosting platforms such as Google Workspace, Microsoft 365, Zoho Mail, Proton Mail, FastMail, or transactional email services like Mailgun and SendGrid. Each of these platforms uses a specific set of MX hostnames that are shared across all their customers. This shared infrastructure is precisely what makes reverse MX lookup possible and useful — by indexing on the MX hostname, we can identify all domains on the same email platform.

Building and Querying the Database

Every domain DNS lookup performed on IpDnsHub captures the MX records returned for that domain. The MX hostname is stored as the index key, and the domain is recorded as an associated value. When a reverse MX lookup is performed, the database is queried for all domains that have returned a specific MX hostname. The results represent a growing, observation-based dataset rather than a complete registry — results improve over time as more domains are queried through the platform.

Common Use Cases

Email Platform Adoption Research

Understanding Which Domains Use a Specific Email Provider

Marketing analysts and technology researchers use reverse MX lookup to understand the adoption of email hosting platforms within specific market segments. By querying known MX hostnames for Google Workspace (aspmx.l.google.com), Microsoft 365 (mail.protection.outlook.com), or Zoho Mail (mx.zoho.com), they can identify clusters of domains using each platform. This provides data-driven insight into email hosting market share and enterprise technology choices.

Domain Portfolio Auditing

Verifying Consistent Email Infrastructure

Organizations managing a large portfolio of domains — holding companies, franchises, brand families — can use reverse MX lookup to verify that all domains in the portfolio are correctly routed through the intended mail platform. If some domains appear under a different MX hostname than expected, it may indicate a missed configuration, a stale MX record from a previous email provider, or a domain that was acquired but not yet migrated to the standard mail platform.

Email Security and Threat Intelligence

Identifying Domains on Shared Infrastructure with Spam Sources

If a domain is identified as a source of spam or phishing, and that domain's MX hostname is known, a reverse MX lookup may reveal other domains sharing the same mail server. This can expose additional domains controlled by the same threat actor, or domains that are co-hosted on a compromised shared mail server. Security teams use this during threat actor attribution and email blocklist investigations.

Competitive Intelligence

Mapping a Competitor's Email Infrastructure

A competitor's email hosting choice is visible in their MX records — and by extension, so may be their domain portfolio. A reverse MX lookup on a known competitor's MX host may reveal additional domains in their portfolio that are not publicly advertised. Combined with reverse NS lookup, this provides a multi-dimensional view of a competitor's internet infrastructure.

Technical Reference

Frequently Asked Questions

What is an MX record?

An MX record (Mail Exchanger record) is a DNS record that specifies the mail server responsible for accepting inbound email messages on behalf of a domain. When an email is sent to any address at a domain, the sending SMTP server queries the domain's MX records to find the correct delivery destination. MX records always point to a hostname (never an IP address directly), and that hostname must have its own A record resolving to the mail server's IP. Every domain that receives email must have at least one MX record configured.

Why would I look up domains by MX record?

The most common reasons are: (1) infrastructure auditing — confirming all your domains route email through the correct platform; (2) competitive intelligence — understanding which email platform a competitor or set of domains uses; (3) security research — identifying other domains co-hosted on a mail server associated with spam or abuse; and (4) market research — measuring the adoption of email hosting platforms across a dataset of domains. The reverse MX lookup surfaces domain relationships that are invisible when examining any single domain's DNS records.

What does the MX priority value mean?

The MX priority (also called preference) is a non-negative integer that determines which mail server is tried first when multiple MX records exist. A lower number means higher priority. The sending mail server always attempts to connect to the lowest-priority (numerically) MX host first. If that host is unreachable or returns a temporary error, the sender falls back to the next-highest priority host. Two records with the same priority value are used in round-robin fashion. Priority values are chosen by the zone operator and are meaningful only in relation to each other — a priority of 10 is not inherently better or worse than 1; only the relative ordering matters.

Can I have multiple MX records for one domain?

Yes, and it is best practice to do so for redundancy. If the primary mail server is temporarily unavailable, sending servers will retry delivery to secondary and tertiary MX hosts. Google Workspace, for example, configures five MX records for each customer domain. Microsoft 365 uses a single MX host but relies on its own internal redundancy. When configuring multiple MX records, ensure each MX hostname has a valid A record and that your email provider's documentation confirms which priority values and hostnames to use. Incorrect MX configuration — such as a missing A record on an MX host, or both MX records pointing to the same IP — can result in email delivery failures.

Conclusion and Takeaways

MX records are the backbone of email routing on the internet, and the ability to look up domains by MX host unlocks a powerful layer of infrastructure intelligence. Whether you are auditing your own domain portfolio for email configuration consistency, researching the email hosting choices of competitors, or investigating suspicious mail server infrastructure, the Reverse MX Lookup tool provides instant, data-driven answers. As the IpDnsHub dataset grows with each query made through the platform, the coverage and accuracy of reverse MX results continue to improve.