DNS MX records

About MX entries

So now you have your working mail server. But how do emails find you? The answer lies in the most important service on the internet: DNS. Assume that you are the owner of the gmail.com domain. And a mail server somewhere on the other end of the internet wants to send an email to john@example.org. What the other mail server needs to do is find out which server on the internet it will have to establish an SMTP connection to in order to deliver the email. Let’s reiterate how that happens:

ispmail-jessie-bigpicture-mx

The remote server queries its DNS server for the MX (Mail eXchanger) record of the “example.org” domain. If no MX record was found it tries again and asks for A (address) records. Let’s run a query for a real domain to get an idea:

$> host -t MX gmail.com
gmail.com mail is handled by 10 alt1.gmail-smtp-in.l.google.com.
gmail.com mail is handled by 20 alt2.gmail-smtp-in.l.google.com.
gmail.com mail is handled by 30 alt3.gmail-smtp-in.l.google.com.
gmail.com mail is handled by 40 alt4.gmail-smtp-in.l.google.com.
gmail.com mail is handled by 5 gmail-smtp-in.l.google.com
.

So as a result we get 5 different MX records. Each of them consists of a priority and the host name of the mail server. A mail server would pick the entry with the highest priority (=the lowest number) and establish an SMTP connection to that host. In this example that would be the priority 5 server gmail-smtp-in.l.google.com. If that server could not be reached then the next best server with priority 10 would be used and so on. So all you have to do in your own DNS zone is add an MX entry pointing to your mail server. If you want to run a backup mail server (which is outside of the scope of this tutorial) then you can add a second entry with a an equal or lower priority.

A mistake some people make is using an IP address in MX records. That is not allowed. An MX record always points to a host name. You will have to add an A record for your MX record to point to the actual IP address of your mail server.

(In the above example it is very unlikely that a mail server will ever have to use the server with priority 40. Adventurous system administrators can add such a low-priority entry and see who connects to it. An interesting observation is that spammers often try these servers first – hoping that it is just for backup purposes and less restrictive than the main server. If you see someone connecting to the lowest-priority address first without having tried a higher-priority mail server then you can be pretty certain that it’s not a friend who’s knocking at your door.)

Fallback to A entries

It’s always best to explicitly name mail servers in the MX records. If you can’t do that for whatever reason then the remote mail server will just do an A record lookup for the IP address and then send email there. If you just run one server for both the web service and the email service then you can do that. But if the web server for your domain is located at another IP address than your mail server then this won’t work.

7 thoughts on “DNS MX records”

  1. Have SPF Records been deprecated? Should they still be used? Can you give an example of a DNS Entry for MX please?

    Currently I am using following setup in my DNS-Entry: (IP is made up)

    mail IN A 192.168.1.24
    @ IN MX 10 mail
    @ IN TXT “v=spf1 ip4:192.168.1.24 a mx -all”

    But I have also seen MX records that give the full fqdn, like so:
    @ IN MX 10 mail.example.com.

    What should be used?

  2. Hallo Christoph,

    First of all let me say thank you for your great iISPmail guide, very helpful.

    Maybe of use for you could be a very interesting option I’ve found in “The” Kofler (LINUX by Michael Kofler) :

    For the very common situation like mine – small vserver with just one IPv4 address – there’s an option to use e.g. MAIL.domain.tld as mail hostname with a A/AAAA records but NOT for MX and PTR records. I’ve searched a while for it, because I don’t like e.g. WWWW.domain.tld rDNS-pointing to MAIL.domain.tld, only because of SPAM STMP-relay issues. It works in one case: A/AAAA record for domain.tld, and the MX also pointing to the Domain, NOT a sub domain.

    Tested with my Deutsche Telekom t-online.de emeil address, the DTAG SMTP servers are, for good reason :-), very restrictive.

    Thanks again,
    Michael

  3. Hi Christoph!

    Can you please tell about DKIM for multi domain mail server?

    Thank you.

    1. You can use DKIM for multiple domains, just use a new line for each domain in each of the three tables.

  4. Hi, I am trying to register on a website and it says ’email address has no mx records configured’. I am using a free zoho email account. How can I change my email mx records? I don’t have my own domain.

    Thanks, Ray

Leave a Reply to Paul Cancel reply

Your email address will not be published. Required fields are marked *

Scroll to Top