Bulk mail server lookup: where is each domain's email hosted?
In short: Paste domains and follow each one's MX records to the servers: every MX host with its IP address, reverse DNS name and the network (ASN) behind it, plus the provider the MX names. Limit: Addresses, PTR names and networks are looked up for the first three MX hosts only.
A bulk mail server lookup follows each domain's MX records to the machines that receive its mail. Paste up to 100 domains or email addresses, or 500 after a free Google sign-in, and each row lists up to three MX hosts with their IP address, reverse DNS (PTR) name and the network that announces the IP (ASN and name), plus the provider. DNS only, no SMTP. CSV out.
Price: this tool is free. Checking a whole email list is from $9/mo, and the first 100 checks are free with Google, no card. Check your list free nowSee pricing
Sample result
globex.example has one MX host, on its hosting company's network.
- Domain
- globex.example
- MX
- mail.globex.example
- IP
- 203.0.113.25
What this means for you
One MX host on one network means one outage stops all of its incoming mail.
- MX hosts in priority order
- IP, PTR name and ASN per host
- Single MX and one-network flags
- One CSV line per MX host
- MX
- ASN
- PTR
By SimpleVerifier Team · Last updated
Also in: Português (Brasil) · Español · Deutsch · Français · Türkçe · 简体中文 · Русский · Nederlands · Italiano · Tiếng Việt · Bahasa Indonesia · Polski · العربية · Українська · Čeština · Magyar · 日本語 · 한국어
Mapping the mail servers behind a lead list?
- Knowing who hosts a domain's mail tells you how its server will treat cold email, not whether each address exists. Upload the list at /verify to remove addresses that would bounce.
- The first 100 email checks are free with a Google sign-in, no card. To split a big list by provider only, use the bulk email provider lookup.
How do I find where many domains host their email?
- Paste domains or email addresses, one per line, up to 100 a run or 500 after a free Google sign-in.
- Press Look up mail servers. Each domain's MX records are read, then the first three hosts' addresses, PTR names and networks, 10 domains a request.
- Read each row: the provider, every MX host in priority order with its IP, PTR and ASN, and flags for a single MX host or all hosts on one network.
- Filter by network or provider and download the CSV with one line per MX host.
Example
- You enter
- Two domains:
acme.example(Google Workspace MX) andglobex.example(one self-hosted MX). - You get
- acme.example: Google Workspace, each MX host with its IP, PTR name and network. globex.example: one MX host on its hosting company's network, flagged Single MX. Download the CSV, one line per MX host.
- Limits
- Up to 100 a run without an account and 500 when signed in with Google, counted over a minute. 10 domains a request; DNS only, no SMTP.
What does the lookup do for each domain?
It reads the domain's MX records (RFC 5321 says senders try them in priority order), takes the first three hosts, and resolves each to its IPv4 address (IPv6 when there is none). Each IP then gets a PTR lookup for its reverse DNS name and a query to Team Cymru's IP to ASN service for the network that announces it.
Everything is DNS. Nothing connects to the mail servers, so the lookup can't be seen by the domain's owner and never affects its reputation or yours.
Why look past the provider name?
The bulk email provider lookup names the provider from the MX host name. This tool shows the infrastructure under it: whether a domain whose MX is mail.acme.example runs on a cloud provider, a web host or its own office line, whether the MX hosts all sit on one network (one outage stops all mail), and whether a gateway sits in front of the mailboxes.
A null MX (MX 0 ., RFC 7505) means the domain takes no mail at all, and is shown as such.
What do the flags mean?
Single MX: the domain lists one MX host. Common and fine with big providers, a risk with a self-hosted server. One network: every MX host's IP is announced by the same ASN. No PTR: an MX host's IP has no reverse DNS name, which is unusual for a real mail server. The flags describe the records; they don't predict whether a given address accepts mail.
Who uses this tool, and for what?
- Deliverability teams
- See which prospects run their own mail servers and which sit behind Google, Microsoft or a gateway.
- Sales researchers
- Find companies whose mail runs on a given cloud or hosting provider.
- IT auditors
- Spot domains with one MX host, or all MX hosts on one network, across a portfolio.
- Security teams
- Map a vendor list's mail servers to their networks before a review.
What can’t this tool tell you?
- Addresses, PTR names and networks are looked up for the first three MX hosts only.
- The ASN country is the network's registration country, not the server's location.
- Shows the MX records as published; it doesn't test whether an address accepts mail.
- Up to 100 domains a run without an account, 500 signed in.
Common questions
- How do I find where a list of domains hosts its email?
- Paste them into a bulk mail server lookup like this one. It follows each domain's MX records to the IPs, reverse DNS names and networks of its mail servers, with a CSV.
- Is this bulk mail server lookup free?
- Yes. Up to 100 domains a run without an account, and up to 500 a run when you sign in with Google, with no card.
- Does it connect to the mail servers?
- No. It uses DNS only: MX, A or AAAA, PTR and TXT queries to Team Cymru's ASN service. No SMTP connection is made.
- Why are only three MX hosts shown?
- Senders try MX hosts in priority order, and almost all domains have three or fewer. The CSV lists every host's name; addresses and networks are looked up for the first three.
- Is the ASN country where the server is?
- No. It is the country the network registered, which can differ from where the server runs.
- What is the difference from a bulk MX lookup?
- A bulk MX lookup lists the MX host names and whether the domain can receive mail. This tool adds each host's IP, reverse DNS name and network.
Sources
A tidy list can still be full of dead addresses.
Extracting, deduplicating and syntax checks all work on the text of an address. None of them can tell whether the mailbox exists. Only the server that hosts it can answer that, through an SMTP check, and that is what the paid product does.
- Upload the cleaned file as it is: CSVs up to 100,000 rows
- A real SMTP mailbox check on every row, with catch-all detection
- Small list? Starter at $9/mo covers 2,500 emails a month, cancel anytime
Plans from $9 a month, cancel anytime, no contract. Sign in with Google and your first 100 email checks are free, no card. The free tools stay free either way.