Mail provider detection

What this tool checks

The tool reads two kinds of DNS records and names the services behind them:

MX records, which say where mail for the domain is delivered. These usually point to a mailbox provider such as Google Workspace, Microsoft 365, Proton Mail or Fastmail, or to a filtering gateway such as Mimecast, Proofpoint or Barracuda in front of one.
The SPF record and its include tree, which list the services allowed to send mail as the domain. Besides the mailbox provider these are often sending services for newsletters and transactional mail, such as Amazon SES, SendGrid, Mailgun or Postmark.

Each provider found is shown with its kind (mailbox, gateway or sending service), whether it was found in MX, SPF or both, and the host names that matched. The lookups are the same as in the MX lookup and the SPF check; nothing else is queried.

How to read the result

All findings are information. MAIL_NO_MX means the domain has no MX records or a null MX, so it does not receive mail through a provider. MAIL_PROVIDER_UNKNOWN means the MX hosts match nothing on the list. MAIL_PROVIDER_MIXED points to an SPF include for a second mailbox provider, which often remains after a migration.

A gateway in front of a mailbox provider is normal: mail arrives at the gateway's MX hosts, while the mailbox provider sends outgoing mail and appears in SPF. That combination is not reported as mixed.

Limitations

Detection is pattern matching on DNS records. A provider that is not on the list, or that a customer reaches through custom host names, is not recognised.
The tool does not connect to mail servers and does not see how mail is routed after the first MX host.
SPF macros are not expanded, so includes that depend on them are not matched.

Use it from code

API reference for Mail provider detection

curl -i "https://api.lookproof.dev/v1/mail/provider?domain=example.com"

A request without payment is answered with 402 Payment Required and the exact price. See the API reference.

Limits

Input	Domain
Deadline	10 seconds
Freshness	Up to 5 minutes, never longer than the record TTL
Price	$0.005 per check

Findings this tool can report

Mail provider (3)

Info MAIL_NO_MX The domain has no MX records, so no inbound mail provider can be named.
Info MAIL_PROVIDER_MIXED SPF authorises a mailbox provider that does not receive the domain's mail.
Info MAIL_PROVIDER_UNKNOWN The MX hosts match no provider on the list.

Check (1)

Warning CHECK_QUERY_BUDGET_EXCEEDED The check stopped after reaching its DNS query limit.

DNS (3)

Error DNS_DOMAIN_NOT_FOUND The DNS resolver reported that the domain does not exist.
Warning DNS_RESOLVER_FAILURE The DNS resolver returned a server failure.
Warning DNS_RESOLVER_TIMEOUT The DNS resolver did not answer in time.

Frequently asked questions

How does the tool know which provider a domain uses?

Mail providers give their customers fixed DNS values. Google Workspace customers point MX at hosts under google.com and add include:_spf.google.com to SPF, Microsoft 365 customers use mail.protection.outlook.com, and so on. The tool compares the domain's MX hosts and every domain in its SPF include tree with a fixed list of these patterns.

What is the primary provider?

The provider behind the MX host with the lowest preference number, which is where other servers deliver mail first. If that host matches nothing on the list, there is no primary provider, even when other MX hosts or SPF includes match.

Why does it say mixed?

MAIL_PROVIDER_MIXED means the MX records point to one mailbox provider while SPF also includes another one. During a move between providers that is expected. Afterwards, an include for the old provider lets that provider's other customers pass SPF as your domain, so it is worth removing.

My provider is not recognised. Is something wrong?

No. MAIL_PROVIDER_UNKNOWN only says the MX hosts match no entry on the list. The domain may run its own mail servers or use a smaller provider. The list is versioned, and the version is shown with every result.