mx resource records don't require that the questioner know the answer already.
For an mx resource record to work for mail.example.com., the questioner would have to already know that mail.example.com. was the target. Clearly, that's nonsense.
When mail is addressed to postmaster@example.com, the domain name looked up is the one in the mailbox name, example.com.. That is the domain name which must own the mx resource records (if any). These resource records form the first halves of two-part mappings from the mailbox domain name to sets of IP addresses:
example.com. IN MX 10 a.mx.example.com.
example.com. IN MX 20 b.mx.example.com.
a.mx.example.com. IN A 10.25.0.1
a.mx.example.com. IN A 10.25.0.2
b.mx.example.com. IN A 10.25.1.1