0

I have a need to know when an MX record changed. I know from previous messages that there isn't much online that can help me determine the exact timing of the change, but is there a way in my historical email from around the time to see changes to how the email was routed as a result of the MX record changing?

2
  • 2
    Your mail server logs contain the record to which servers outgoing email was delivered, which typically corresponds to the MX records at the time. Your incoming mail show that route the message followed in the headers, yes, but that only tells you something about your own domain.
    – HBruijn
    Nov 30, 2014 at 16:44
  • Personally, Jeremy I don't think your question is close worthy. You don't provide a lot of research outside of the linked SF question, but the question is succinctly stated with accurate tags and worth future visitors seeing.
    – TheCleaner
    Dec 1, 2014 at 20:23

1 Answer 1

3

The email headers do not directly record the MX record. At best you can infer one or more hosts that were listed in the MX records. In most cases, you will only be able to infer the primary (highest priority) mail server. Some servers do a bad job of reporting their identification, so you may get misleading information.

For incoming mail, the host that received the email from the Internet should be the host listed in the highest priority MX record. The incoming mail logs can also be used for incoming messages.
The mail server log for a host which frequently send email to a domain should have similar information. The log should record the host to which the mail was delivered. This host should be the host for the highest priority MX records.

Some organizations have many hosts acting as primary (highest priority) MXs. In this case you will likely get a partial response.

DNS results are cached and it is common for changes to take a while to propagate. As a result it is likely you will only be able to specify the day(s) when the change was made.

The server logs for the primary DNS server may be a better source for this information. They may indicate when the DNS zone was last reloaded. If your DNS zone files used the recommended date based serial numbers they may help as well.

Not the answer you're looking for? Browse other questions tagged .