MX record

What it does and does not tell you

An MX (mail exchanger) record names the server that accepts mail for a domain. Each has a priority; the lowest number is tried first, and the others are fallbacks.

10 mail.company.com.
20 backup.company.com.

Having an MX record means the domain can receive mail somewhere. It says nothing about whether a particular mailbox exists. That is a separate question, asked of the server the MX record names. See SMTP verification.

What the hostname reveals

The MX target usually tells you who runs the company's email:

• aspmx.l.google.com or smtp.google.com — Google Workspace.
• company-com.mail.protection.outlook.com — Microsoft 365.
• A gateway such as Proofpoint or Mimecast in front of either.

This matters for outreach. Different providers react differently to verification probes, and a gateway in front can accept everything and make the domain look like a catch-all when the mailboxes behind it are not.

Edge cases

• No MX record: by the SMTP standard, mail falls back to the domain's A record. In practice most such domains do not receive mail.
• Null MX (`0 .`): defined in RFC 7505. The domain is explicitly stating that it accepts no mail at all. Do not try to find addresses there.

Priorities, and why a backup can mislead

Servers with the same priority share the load; senders try the lowest number first and move to the next only if it is unreachable. A backup MX is meant to hold mail while the primary is down, but older setups sometimes configure the backup to accept every recipient and sort it out later. A verifier that happens to reach the backup can be told "yes" for an address the primary would have refused, which is one more way a domain ends up looking like a catch-all when it is not.

Check any domain with the MX lookup tool.