MX records: priority and mail flow

Lower priority means preferred (the universal trap). MX targets must be hostnames, never CNAMEs or IPs. The canonical mail-migration sequence.

MX records tell mail servers where to deliver a domain’s mail. Wrong MX records mean missed email, which clients notice within hours and remember for years. The two pitfalls are subtle: the priority field works the opposite of what newcomers expect, and there are spec-level rules about what an MX can point at that the DNS host’s panel won’t always enforce.

What an MX record is

zone snippettext

1		example.com. 3600 IN MX 10 aspmx.l.google.com.
2		example.com. 3600 IN MX 20 alt1.aspmx.l.google.com.
3		example.com. 3600 IN MX 30 alt2.aspmx.l.google.com.

When mail for user@example.com is sent, the sending server queries dig MX example.com, gets back the records, picks the lowest priority number, and tries to deliver there. If unreachable, it tries the next-lowest priority.

The “lower means preferred” inversion

MX priority is inverted

Lower numbers are preferred. Higher numbers are fallbacks. Convention: 10 for the primary, 20 / 30 for backups.

Priority 10 → mx1.example.com.   (primary, tried first)
Priority 20 → mx2.example.com.   (backup, tried only if mx1 unreachable)

This inversion is the single most common MX surprise. A new tech reads priority 50 and thinks it’s higher-priority than priority 10. It’s not.

What an MX can point at

MX targets must be hostnames (FQDNs), not IPs, and the target must have an A or AAAA record at the end of the chain. Two spec violations to recognise:

MX pointing at an IP address. RFC 5321 requires hostnames. Some DNS hosts let you save the IP form; many receivers reject and the mail bounces.
MX pointing at a CNAME. RFC 2181 prohibits MX-to-CNAME. Some receivers follow the chain; others reject. The defensive practice is to point MX directly at the final FQDN with its own A/AAAA records.

If a vendor’s setup instruction asks for an IP-as-MX, ask them for a hostname. Reputable mail providers publish one.

What this is NOT

“Higher priority means it’s the main one.” Backwards. Lower is preferred.
“Multiple MX records means parallel delivery.” Backups are only tried when the primary fails. Records at the same priority are the parallel case.
“You can put a CNAME or an IP in an MX target.” Both are spec violations. Modern hosts mostly enforce; older or laxer ones don’t. The defensive answer is always: hostname with A/AAAA.

Decision walkthrough

What's wrong and how do you fix it?

A client emails: we moved to M365 last week but mail still goes to the old server occasionally. dig MX example.com returns two records: priority 10 oldmail.example.com and priority 20 example-com.mail.protection.outlook.com.

First, what's the actual issue?

Loading quiz…

Next lesson →