MX record points at an IP address instead of a hostname
What this check looks for
One of your mail server records contains an IP address where a hostname is required. Many sending servers will not deliver mail to it at all.
Why it matters
Inbound delivery becomes dependent on how forgiving each sender is, which produces the worst kind of problem: mail from some senders arrives and mail from others silently does not.
When the check passes, your report says: “Every MX record names a hostname, as the standard requires”.
What it costs your score
When this check fails it removes 20 points from your Email transport score, before the status, confidence and repeat multipliers are applied. Email transport carries a weight of 8 in the overall score.
It shares the email-transport.mx family ceiling of 30 points: however many findings that family produces, together they cannot remove more than that from Email transport. One underlying problem showing up in several places is still one problem.
- Severity
- high
- Default confidence
- confirmed
- Status when triggered
- fail
- Deduction
- 20 points
- Family cap
- email-transport.mx · 30
- Category
- Email transport
- Module
- Email mx
- Fix owned by
- dns host
- In the ruleset since
- 2026.09
How to fix it
Point the MX at a hostname and give that hostname an A/AAAA record.
An IP literal is not a valid MX target; some senders refuse to deliver and TLS name checks cannot pass.
Create a hostname such as
mail.‹domain›with an A record for ‹mx target› (and AAAA if you have IPv6).Change the MX record to point at that hostname.
Make sure the mail server's TLS certificate covers that hostname.
How to confirm it worked
dig +short MX ‹domain› — the target must be a hostname, not an IP address
mail.{{domain}}. 3600 IN A {{mxTarget}}
{{domain}}. 3600 IN MX 10 mail.{{domain}}.A named slot like ‹domain› — and the braces left in the configuration below — is filled in with your own values when this rule appears on a report.
Technical detail
The MX for ‹domain› has target ‹mx target›, which is an IP address literal. RFC 5321 §5.1 requires the MX RDATA to be a domain name that resolves to an address record; an IP literal is not a valid target and cannot be used for TLS certificate name matching either.
Standards and references
Test this on your domain
Run the check that produces this finding, on its own, against any domain.
Other email mx checks
- Two MX hosts share the same preference value
- MX record points at a CNAME
- Mail server address has no reverse DNS name
- MX host does not resolve to an address
- No MX record — this domain cannot receive email
- Every mail server resolves to the same address
- Domain publishes a null MX (receives no mail)
- Only one mail server host is published