MX lookup and mail server test on the command line

MX record on Windows: nslookup

nslookup with -type=MX lists the mail servers of the domain with their priority. The lowest number is the preferred server. A name server as the last argument asks the source directly instead of the local cache.

nslookup -type=MX example.com
nslookup -type=MX example.com 8.8.8.8
nslookup -type=MX example.com ns1.host.com

The output reads like "example.com MX preference = 10, mail exchanger = mail.example.com". If only the SOA record or "Non-existent domain" appears instead, there is no MX record; mail is then delivered to the domain's A record as the RFC prescribes, which is almost never intended.

MX record on Linux and macOS: dig

dig with +short shows only priority and host. The second line then resolves the mail servers to IP addresses, the third asks the authoritative name server.

dig example.com MX +short
dig example.com MX +short | awk '{print $2}' | xargs -I{} dig {} A +short
dig @ns1.host.com example.com MX +short
dig -x 203.0.113.10 +short

The last command is the reverse lookup of a mail server IP. It matters for sending: many receivers reject mail from servers whose IP has no PTR record or whose PTR does not point back to the same IP.

MX record in PowerShell

Resolve-DnsName returns objects with the fields NameExchange and Preference, which can be sorted and used in scripts.

Resolve-DnsName example.com -Type MX | Sort-Object Preference | Select-Object Preference, NameExchange
Resolve-DnsName example.com -Type MX -Server 1.1.1.1 -DnsOnly

Test the mail server on port 25

Whether the mail server behind the MX actually accepts mail is shown by a connection on port 25. If it answers, it greets with a 220 line and its host name. With EHLO and a MAIL FROM/RCPT TO you can check whether an address is accepted without sending a message; QUIT ends the session cleanly.

telnet mail.example.com 25
nc -vz mail.example.com 25
openssl s_client -connect mail.example.com:25 -starttls smtp </dev/null

# in the session:
EHLO test.example
MAIL FROM:<test@example.org>
RCPT TO:<info@example.com>
QUIT

Many home and office networks block outgoing connections on port 25; a timeout then does not mean the server is down. Test from a server or through an online tool. On Windows telnet is not installed by default; Test-NetConnection mail.example.com -Port 25 in PowerShell covers the connection test.

Typical MX mistakes that show up

What the lookup shows and what it means:

• No MX record: mail goes to the domain's A record, usually the web server, which accepts no mail.
• MX pointing to a CNAME: violates the standard, some senders refuse delivery.
• MX pointing to an IP address instead of a host name: invalid, ignored by many servers.
• Mail server not resolvable: the MX host has no A record, for example after a hosting move.
• Old and new MX mixed: after switching to Microsoft 365 or Google Workspace mail keeps arriving at the old provider depending on priority.
• Null MX (0 .): the domain explicitly accepts no mail. Right for web-only domains, wrong for everything else.
• Trailing dot missing in the zone file: mail.example.com becomes mail.example.com.example.com.

In agency work

The MX checker queries authoritatively, resolves every mail server and flags the mistakes above. For the question whether a client quietly switched mail providers there is monitoring: DomainWarn stores the MX records of all client domains and reports the change before the client asks why the forwarders stopped working.

Frequently asked questions

Which MX is used when several are listed?

The one with the lowest priority. If it is unreachable, the sender tries the next. Equal priorities are distributed randomly.

The MX points to outlook.com but mail still does not arrive.

Then the mailbox is usually not created in the Microsoft 365 admin center yet or the domain is not verified there. The server accepts the connection but rejects the address, which RCPT TO reveals.

Can I set the MX of a subdomain?

Yes, every host name can have its own MX records. shop.example.com can route mail to a different provider than example.com.