Loading
Loading
Run a reverse MX lookup by entering a mail server hostname to discover every domain that receives its email through it. Search with exact matching or wildcards to map shared email infrastructure in seconds.
DNS itself has no built-in way to answer this question. A resolver can only travel from domain to record, not the other way around. Reverse MX lookups are made possible by large passive DNS datasets that index MX records across the internet, then let you query that index in reverse.
When you run a search, the tool queries an indexed database of MX records collected from domains across the global DNS. It matches your input against the mail server field of every stored MX record and returns the domains that point to it.
You get two matching modes:
| Query | What It Matches |
|---|---|
| google.com | Domains with MX records pointing exactly to google.com |
| *.gmail.com | Domains using any mail server hostname ending in .gmail.com |
| m*.g*.com | Mail server hostnames starting with "m" under a domain starting with "g" and ending in .com, such as mail.google.com |
| *.protection.outlook.com | Domains routing mail through Microsoft 365 |
| MX Lookup | Reverse MX Lookup | |
|---|---|---|
| Input | A domain name (example.com) | A mail server hostname (mx.example-host.com) |
| Output | The mail servers and priorities for that domain | All domains pointing their MX records to that server |
| Data source | Live DNS query against authoritative name servers | Indexed passive DNS database |
| Primary use | Verifying email configuration and deliverability | Infrastructure mapping, security research, and investigations |
Forgotten MX records on unused subdomains are a known attack vector. Searching for your organization's mail servers with wildcards can surface old or orphaned domains still pointing at your infrastructure, so you can clean them up before someone exploits them.
Sales and market research teams use reverse MX lookups to build lists of companies using a specific email provider, such as Google Workspace (.google.com MX patterns) or Microsoft 365 (.protection.outlook.com). The results double as targeted prospect lists for outreach.
An MX (Mail Exchange) record is a DNS record that tells the internet which server accepts email for a domain. Each record includes a priority value; lower numbers are tried first, and higher numbers act as backups. A domain can list multiple mail servers for redundancy, and thousands of domains can point at the same mail server, which is exactly the relationship a reverse MX lookup uncovers.
Enter a mail server hostname, not a regular website domain. For example, enter aspmx.l.google.com rather than a company's website address. If you only know the domain, first run it through an MX lookup to find its mail server, then search that hostname here.
A reverse DNS lookup resolves an IP address to a single hostname using PTR records, which you can test with our IP to hostname lookup. A reverse MX lookup searches an indexed database to find all domains using a given mail server. They answer different questions about different record types.