Say I check the MX records for the domain example.com and find that it's MX record points to mail.example.com.

I know how to go from domain name to MX record. I'd like to go the other way around. I want to find all domains that are using the same mail server based on all DNS MX records, in this case mail.example.com.

Is there a non-brute force/case-by-case way of doing this?


Is there a non-brute force/case-by-case way of doing this?

Assuming you don't have access to the target mailserver, no, there is not.

  • How would having access to the mailserver help? You would look at which domains it was configured to receive mail from instead of looking at MX records? – Peter Jun 15 '16 at 18:10
  • Yep, that's correct. It's not a for-sure 1:1 mapping between MX records and domains it will accept, but it's very close. – EEAA Jun 15 '16 at 18:11

I ran across a website hosted by the Censys Team at the University of Michigan called the Internet-Wide Scan Data Repository. They scan the entire IPv4 address range regularly, checking out websites, open ports, SSL certificates, etc... for each scan they run they also take the time to do a DNS lookup and store the results as a separate package for download.

Project Sonar includes a regular DNS lookup for all names gathered from the other scan types, such as HTTP data, SSL Certificate names, reverse DNS records, etc

The dataset contains snapshots taken within a timeframe of maximum 8 hours each. New snapshots will be added as additional data is collected. The forward DNS requests are made with record type 'ANY' which results in all kinds of result records being returned. The first upload contained only the following types: A, AAAA, CNAME, MX, NS, PTR, SOA, TXT. Since then we've changed the parsing library (ldns) and are now uploading all records we retrieve, as far parsed as possible. The data might contain unknown record types and known but incorrect ones next to all the different parsed types.

Now I know that this won't be a complete list, but it does include MX records for any domains that were picked up through other scanning means. I extracted the file, ~70GB's unzipped, then ran a parallel grep on it for the mail server in question (Mailinator). I was able to track down ~460 distinct domains that all use the same mail server using this method.


I'm afraid you are out of luck. The DNS universe is not locally administered and all the information is not in one place. The number of domains out there now is pretty huge and it would take a very long time to retrieve this information from all the various sites.

  • I know there are providers of historical DNS/Whois data. My thought was maybe one of these providers who is aggregating all this data already had a handy search tool. My guess is someone already has all this data, and the search interface just might not exist. – Peter Jun 15 '16 at 18:09

There's no way to get that information.

Brute force is not an option, because although the list of tlds is public, most tld administrators doesn't publish a list of domains registered under their tld.

And access to the mailserver wouldn't really help. First of all many bigger providers (and a lot of hobby set ups, like mine) store that information in a database, and at some providers getting access to the list of domains they would accept mail for doesn't mean they actually handle mail for that domain, the MX records might point somewhere else (but doing MX lookups to filter the list, would be enough, but for some providers you'd have to do a lot of MX lookups).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.