How to Find Which Email Provider a Domain Uses (MX Lookup Explained)

Every domain that receives email publishes where its mail should go, in public DNS records called MX records. Read them and you usually know the provider in seconds: Google, Microsoft, Zoho, a hosting company, a forwarding service, or a self-hosted server. That is useful when you take over a client's IT, when you are checking a supplier before a migration, when you are deciding whether a suspicious message could really have come from a company, and when you simply want to know whether a competitor pays for Workspace. Here is how to look, what the hostnames mean, and when the answer is hidden.

Quick answer

Run the domain through the free MX lookup. It lists the mail servers in priority order and names the provider for the common ones. If you prefer the command line, dig MX example.com or nslookup -type=MX example.com returns the same hostnames; match them against the list below.

Hostnames and what they mean

• aspmx.l.google.com, alt1.aspmx.l.google.com and similar: Google Workspace (or legacy G Suite).
• example-com.mail.protection.outlook.com: Microsoft 365 / Exchange Online. The first label is the domain with dots turned into dashes.
• MX (Mail Exchanger — where incoming email is delivered).zoho.com, mx2.zoho.com, mx3.zoho.com (or .eu, .in): Zoho Mail.
• mail.oqumail.com: OquMail.
• mx1.privateemail.com, mx2.privateemail.com: Namecheap Private Email.
• mx1.titan.email, mx2.titan.email: Titan, resold by Hostinger, Name.com and others.
• mx1.improvmx.com, route1.MX (Mail Exchanger — where incoming email is delivered).cloudflare.net, mx.forwardemail.net: forwarding services; the real inbox is somewhere else, usually a Gmail account.
• inbound-SMTP (the standard way computers hand off outgoing email).us-east-1.amazonaws.com or similar: Amazon SES receiving, usually an application rather than people.
• mail.example.com or the bare domain, resolving to the same IP as the website: mail hosted on the web server, typically cPanel or Plesk.
• Names ending in mimecast.com, pphosted.com (Proofpoint), barracudanetworks.com, mxrecord.io, or a security vendor: a filtering gateway sits in front, and the real provider is behind it.

Two more clues

• The SPF record (a TXT records (short text lines in DNS used for email security) at the root starting v=spf1) lists who may send for the domain. include:_spf.google.com means Google, include:spf.protection.outlook.com means Microsoft, include:zoho.com means Zoho, and extra includes name the marketing or ticketing tools the company uses.
• DKIM selector names, visible in the headers of any message the domain sent: google._domainkey is Google, selector1 and selector2 are Microsoft 365, zoho or zmail is Zoho. The headers guide shows where to find them.

When the lookup does not tell you

• A gateway in the MX hides the provider. The SPF includes and the DKIM selectors on a received message usually still reveal it.
• A domain with no MX records at all receives mail at its A record, if anywhere. Most such domains do not receive mail; some old setups do.
• A forwarding service means the MX tells you only where mail is forwarded from, not the inbox it ends up in.
• Subdomains can have their own MX. mail sent to name@team.example.com may use a different provider from example.com.

Why this matters in practice

• Taking over a client: the MX, SPF and DKIM records tell you what you are inheriting before anyone sends you a login.
• Planning a migration: the migration guide starts with knowing the current provider, because each one has its own export path.
• Checking a suspicious message: if the From domain's MX is Google but the message was signed by an unrelated service with no SPF include for it, treat it as forged.
• Sales and partnerships: a company on Workspace or Microsoft 365 has an IT budget and an admin; one on a web host's bundled mail usually does not.

Common questions

Is this legal and is it private?

MX records are public by design; every mail server in the world reads them to deliver mail. Looking them up is not an intrusion, and the checker runs in your browser without recording the domain.

Can a company hide its provider?

Partly, with a gateway or a custom hostname that CNAMEs to the provider. A dig on the hostname's CNAME chain usually resolves it.

What does my own domain show?

Whatever your provider told you to publish. If the lookup names a provider you no longer use, update the MX; the no MX record guide covers the common mistakes.

Want to see how your own domain is set up? Use the free SPF checker and MX lookup: they run in your browser and store nothing.