MX validation check

MX records are configured in zone.

Mail.

All nameserver IP addresses.

Every 5 minutes.

None.

High.

Purpose

The check validates that the MX records configured for the zone remain unchanged.

DNS is responsible for routing email between MTA’s. This is handled by the MX resource records which assign priorities and destination host names for the Mail Transfer Agents of the authoritative zone.

The only time an MX resource record should change is when the mail infrastructure is changed and in case of a DNS hijacking MX records are one of the records an attacker might want to change in order to route incoming mail through its own “proxy server” for eavesdropping purposes.

The MX validation check validates that the MX records remain unchanged by comparing the result of the check with the MX records that was recorded when the check was set up.

Event severities and messages

The response matches with the expected values.
The CAA records remain unchanged.

No MX records found when they should be.
It appears that the MX records have been removed from the zone. If this is the case, please run a reconfigure in the domain panel to tell the monitoring system that there are no CAA records to check.

Unrecognised records.
Lists records that were received in the query response but does not exist in configuration database.

Missing records.
Lists records that should have been included in the query response but weren’t.

Received RCODE from server.
Please see the Generic DNS response code page for further information.

Solutions, tips & tricks