About this tool
In email fraud cases, a lookalike domain with active MX records is ready to receive replies from a victim, which is a meaningful operational signal distinct from a domain that is merely parked with no mail configuration at all.
Example inputs: example.comdigitpol.coma-supplier-domain.com
What the result shows
- Exchange hostname
- The mail server name configured to receive mail for the domain.
- Preference
- A numeric priority value; lower numbers are tried first by sending mail servers.
- TTL
- How long, in seconds, the record may be cached before being re-queried.
- Response status
- Whether the query resolved, returned no records, or returned NXDOMAIN.
Investigation use cases
- Identifying the email provider behind a domain for a business email compromise investigation
- Comparing MX configuration between a genuine supplier and a suspected impersonation domain
- Confirming whether a newly registered lookalike domain has mail actively configured
- Checking email infrastructure as part of vendor or supplier due diligence
Limitations
MX records show where mail is configured to be delivered, not proof that any specific message was sent or received, and this tool does not inspect message headers or deliver test mail.
Frequently asked questions
Does having MX records mean the domain is actively sending phishing email?
No, it only shows mail is configured to be received; it does not prove any message was sent, received, or malicious.
Can this identify the exact email provider by name?
Often the mail exchange hostname reveals the provider, for example a well-known hosted email service, but this requires reading the hostname rather than a built-in lookup of company names.
Does this check SPF or DMARC too?
No, MX Lookup only covers mail routing records; use the SPF Checker and DMARC Checker tools for those.
Is there a cost to use this?
The lookup is free within daily limits; a sealed report is a paid or account feature.
Need evidence you can keep?
Every lookup produces a full public-source report sealed with a SHA-256 digest. Accounts keep a saved history and can download the DIGITPOL PDF report.