MX Records for Email: Step-by-Step Setup Guide

MX Records for Email: Step-by-Step Setup Guide

MX (Mail Exchanger) is the DNS record that tells sending servers where to deliver mail for your domain. A misconfigured MX means zero mail reaches you, and you only find out from customer bounces. This guide walks through setup for Google Workspace, Yandex 360, Zoho, and self-hosted mail — plus SPF/DKIM/DMARC, without which your mail ends up in spam.

What an MX record is

MX stores the mail server hostname and priority:

example.com.  3600  IN  MX  10  mail.example.com.
example.com.  3600  IN  MX  20  mail2.example.com.

Priority — lower is higher. Senders try priority 10 first; on failure, 20.

RFC 5321 requirements

• MX value is a hostname, not an IP.
• That hostname must have an A or AAAA record.
• MX must NOT target a CNAME (RFC 5321 3.6.2).
• Multiple MX records with different priorities are allowed.

Google Workspace setup

Since 2023 Google recommends a single record with priority 1:

example.com.  3600  IN  MX  1  smtp.google.com.

Legacy five-server ASPMX config still works but new deployments should use the above.

Yandex 360 for Business

example.com.  21600  IN  MX  10  mx.yandex.net.

Add the TXT verification record that Yandex's admin panel provides.

Zoho Mail

example.com.  3600  IN  MX  10  mx.zoho.com.
example.com.  3600  IN  MX  20  mx2.zoho.com.
example.com.  3600  IN  MX  50  mx3.zoho.com.

Self-hosted mail server

example.com.  3600  IN  MX  10  mail.example.com.
mail.example.com.  3600  IN  A  203.0.113.10

Configure reverse DNS (PTR) for the server IP — without it, most recipients classify your mail as spam. See our PTR guide.

SPF: protect against spoofing

SPF (Sender Policy Framework) is a TXT record listing which IPs may send mail as your domain:

example.com.  3600  IN  TXT  "v=spf1 include:_spf.google.com ~all"

• ~all — soft fail (start here).
• -all — hard fail (strict, after debugging).
• +all — allow all (never use).

DKIM: cryptographic signature

DKIM signs each outgoing message with a private key. The public key lives in DNS:

selector._domainkey.example.com.  3600  IN  TXT  "v=DKIM1; k=rsa; p=MIIBIjANB..."

The selector is supplied by your provider — Google uses google._domainkey, Yandex uses mail._domainkey.

DMARC: enforcement policy

_dmarc.example.com.  3600  IN  TXT  "v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com; pct=100"

p=none

Monitor only, no enforcement.

p=quarantine

Failing mail goes to spam folder.

p=reject

Failing mail is rejected.

Verifying MX

Open DNS Lookup and select MX. Or in terminal:

dig MX example.com +short
dig TXT example.com +short
dig TXT selector._domainkey.example.com +short
dig TXT _dmarc.example.com +short

Common mistakes

MX pointing to a CNAME

Breaks RFC 5321. Many servers won't deliver. Use an A record.

Same priority on multiple MX

Allowed but load-balancing is random. Use different priorities for explicit failover.

Stale SPF after provider change

You switched from Gmail to Yandex but SPF still says _spf.google.com. All mail fails SPF. Update SPF alongside MX.

Missing PTR

Google, Outlook.com, Yandex filter mail from PTR-less IPs. Configure reverse DNS with your hosting provider.

Too many SPF lookups

RFC 7208 caps SPF at 10 DNS Lookup. Over the cap means "permerror" and SPF fails. Use include: sparingly.

Debugging non-delivery

1. dig MX example.com +short — correct MX?
2. dig A mail.example.com +short — does the host resolve?
3. telnet mail.example.com 25 — is port 25 open?
4. Check SMTP logs on the receiving side (self-hosted).
5. Run an end-to-end test with MXToolbox SMTP Test.

FAQ

Can MX exist without A?

MX must target a hostname with A/AAAA. Without them, resolution fails.

Does wildcard MX work?

Yes: *.example.com MX 10 mail.example.com — applies to any subdomain without its own MX.

How long does MX propagation take?

Up to the TTL (typically 1h). Lower TTL to 300 one day before the change.

Do I need MX with Office 365?

Yes: example.com MX 0 example-com.mail.protection.outlook.com.

Conclusion

Correct MX is only the start. Reliable delivery also requires SPF, DKIM, DMARC, and PTR. Verify via DNS Lookup and set up MX monitoring to catch issues before customers complain.