DNS, Domains, MX and SMTP

Why it matters: When email "stops working," the cause is almost always a DNS record. Knowing what each record type does tells you where to look in minutes instead of days.

By the end you can:

• Explain how DNS connects a domain to mail
• Tell MX records from sending-authorization records
• Query DNS with dig
• Follow a message from sender to mailbox

Learn (15 min)

1. A domain is a name; DNS publishes answers (5 min)

A registrar sells the domain; authoritative DNS hosting publishes its records. They can be different companies. Editing records at a provider that isn't authoritative for the domain does nothing.

2. Receiving and sending are separate (5 min)

To deliver to person@example.org, a sending server looks up the MX records for example.org, connects to the listed host, and hands off the message using SMTP. MX decides where mail goes. It says nothing about who may send as the domain. That's the job of SPF, DKIM, and DMARC (Lessons 42–44).

3. Follow the message (5 min)

Mail app ──submit──► your provider ──SMTP──► [MX lookup for recipient domain]
        ──► recipient's receiving server ──► filtering ──► mailbox / spam / reject

Successful SMTP handoff ≠ inbox placement. Delivery, authentication, reputation, and filtering are separate outcomes.

Try these (replace the domain with one you own or a public one):

dig +short MX example.org
dig +short TXT example.org
dig +short NS example.org      # who is authoritative?

Apply (15 min)

Worked example (3 min). Fictional zone for example.org:

example.org.                MX    10 mail.example-mailhost.net.
example.org.                TXT   "v=spf1 include:_spf.example-mailhost.net -all"
sel1._domainkey.example.org. CNAME sel1.example-mailhost.net.
_dmarc.example.org.         TXT   "v=DMARC1; p=none; rua=mailto:dmarc@example.org"

Inbound routing: the MX line. Authorized senders: the SPF TXT. Signing key lookup: the DKIM CNAME. Receiver policy: the DMARC TXT. A missing MX breaks receiving at that domain but does not by itself say anything about who can send.

Lab (7 min): Read a real zone.

1. Run the three dig commands on a domain you manage (or a public one).
2. Record MX hosts and priorities, any TXT beginning with v=spf1, and the nameservers.
3. Check _dmarc.<domain> for a TXT record.
4. Write what you can and cannot conclude from each result.

Deliverable: A table: record | value | what it tells you | what it doesn't. You're done when: You've correctly identified who is authoritative for the domain.

Check yourself (5 min)

1. What does an MX record tell a sending server?
2. Does an MX record authorize outbound sending?
3. Can the registrar and DNS host be different companies?
4. Scenario: You add an MX record at your registrar, but nothing changes. Why?
5. Does a successful SMTP handoff prove inbox delivery?

Reference

Common mistakes

Cheat sheet: MX routes inbound mail. SPF authorizes sending sources. DKIM signs. DMARC sets policy for the visible From domain.

Key terms: DNS, registrar, authoritative DNS, MX, TXT, CNAME, SMTP, TTL.

Interview prompts: Walk through how an email reaches a mailbox. How do you tell who hosts a domain's DNS?

Go deeper: SMTP, RFC 5321 · Microsoft 365 DNS records overview

Next: Lesson 42 — SPF.