Definition
MX (Mail Exchanger) records are DNS records that specify which mail servers are responsible for receiving email on behalf of a domain. MX records include a priority value — a lower number indicates higher priority. When a sending mail server needs to deliver a message, it first attempts to connect to the MX server with the lowest priority number (the primary server). If that server is unreachable, the sending server tries the next-lowest priority MX record, and so on until delivery succeeds or all servers have been exhausted. This priority-based failover system ensures that email delivery can continue even when the primary mail server experiences downtime.
A well-configured MX setup includes at least two MX records with different priority values, hosted on different networks to prevent a single point of failure. The primary MX (priority 10) might be hosted on the main mail infrastructure, while the secondary MX (priority 20) could be a backup service such as a mail forwarding or queuing service. The secondary MX is not typically used during normal operation but becomes essential when the primary server is unavailable due to maintenance, network outage, or hardware failure. However, secondary MX servers without proper spam filtering can become an attack vector — spammers may target the backup server if it has weaker security policies than the primary.
Best Practices
-
Configure at least two MX records with different priority values: A single MX record is a single point of failure. If that server goes down, all email to the domain bounces or is queued for retry. Add a secondary MX record with a higher priority number pointing to a different server, ideally on a different network or in a different data centre.
-
Ensure all MX servers have adequate spam filtering and security: A secondary MX that simply accepts all email without filtering becomes a backdoor for spam and malicious messages. Configure anti-spam, anti-virus, and rate-limiting on all MX servers, including backups. A weak secondary MX undermines the security of the entire email system.
-
Use different networks or providers for primary and secondary MX servers: Hosting both MX servers on the same network or with the same provider means that a single outage takes both servers offline. Spread MX records across providers — for example, one with your primary hosting provider and a secondary with a dedicated email backup service such as MxGuard or SpamExperts.
-
Monitor MX server availability and delivery queue length: Use monitoring tools to track whether all MX servers are reachable and responding. A sudden increase in delivery queue length or bounce rate may indicate that the primary MX is unavailable and the secondary is handling the load. Proactive monitoring allows you to address issues before they affect deliverability.
-
Set appropriate TTL values on MX records for failover responsiveness: A shorter TTL — 300 to 600 seconds — allows DNS changes to propagate quickly during a server migration or outage response. A longer TTL — 3600 to 86400 seconds — reduces DNS query volume during normal operation. Balance responsiveness against DNS load based on your operational needs.
Related Glossary Terms
BIMI
BIMI (Brand Indicators for Message Identification) is an email standard that allows brands to display their logo next to their emails in supported email clients. It requires DMARC enforcement at quarantine or reject policy.
Bounce Rate
Email bounce rate is the percentage of emails that were rejected by the receiving server before reaching the recipient. It is a key indicator of list health and data quality.
Email Deliverability
Email deliverability is the ability to land in the recipient's inbox rather than the spam folder. It depends on sender reputation, authentication, list quality, and content practices.
Double Opt-In
Double opt-in (also called confirmed opt-in) is an email signup process that requires a new subscriber to confirm their email address by clicking a verification link in a confirmation email before they are added to your mailing list.
Email Alias
Alternative email addresses or subaddressing patterns that forward to a primary mailbox, affecting subscriber identity tracking and deduplication in email marketing.
Email Authentication
Email authentication (SPF, DKIM, DMARC) is a set of technical protocols that verify an email is genuinely from the domain it claims to be sent from. It prevents spoofing, phishing, and improves deliverability.
Frequently Asked Questions
An MX (Mail Exchanger) record specifies which mail servers are authorised to receive email for a domain. It includes a hostname and a priority number. Lower priority numbers take precedence — sending servers attempt delivery to the lowest-numbered MX server first and fall back to higher-numbered servers if the primary is unreachable.
When a sending server cannot connect to the primary MX (lowest priority number), it waits for a timeout period and then attempts delivery to the next MX record in priority order. The sending server continues retrying the primary MX while also attempting delivery to backup servers. Messages are queued by the sending server until delivery succeeds or the message expires.
At least two MX records on different networks. Three is better for organisations where email uptime is critical. More than three provides diminishing returns because sending servers already queue messages during outages and will continue retrying for multiple days. Focus on diversity of infrastructure rather than raw count.
Yes. If your secondary MX accepts email without spam filtering, it becomes an easy target for spammers. Messages delivered to the secondary MX bypass your primary security infrastructure. Any MX record in your domain must have at least the same level of spam filtering and security as your primary.
Common conventions are priority 10 for primary, 20 for secondary, and 30 for tertiary. The exact numbers do not matter as long as they represent the correct priority order. Leave gaps between values — 10, 20, 30 rather than 10, 11, 12 — so you can insert additional servers between existing ones without reconfiguring all records.