4

In theory, are MX records more susceptible to spammers than A records for mail servers? If a mail server only has an A record, provided the SMTP service is running, mail will still be delivered. Now I understand this is NOT best practice and MX records serve a purpose (redundancy being just one).

But if I dig -t ANY example.com the MX records for the domain would be listed, and exposed.

So, is there any security at all in having an A record only?

1
  • MX records are required for email whereas an A record is not. Not a security issue just functionality. Commented Oct 14, 2016 at 16:45

3 Answers 3

5

Obviously, having only an A record creates some problems for usability and is not a best practice.

According to RFC5321 sec 5, if MX records cannot be found for a domain fallback will occur to the A record for the domain. So that means it won't find smtp.somedomain.com but simply look for the @ record of the domain, and hopefully that's running a server with port 25 open. So what you're saying should work, albeit a holdover from implementations of SMTP in the 90s before MX records were introduced.

Beyond that however, spammers usually get e-mails from databases of known e-mail addresses, for example entered into websites contact forums or mailing lists. In addition they scan the internet by IP address for SMTP servers open on port 25, or the secure ports 465 or 567.

However, the mere fact that an SMTP server is open isn't enough for spammers to guess domains. From there, they conduct an SMTP handshake with the EHLO statement. The SMTP server then replies with the domain name it's configured for, allowing them to guess what e-mails might be at the domain and attempt to send spam to common e-mails (e.g. [email protected], [email protected]).

So, in this case having an A record instead of MX might just lead to more inconvenience on your end, since spammers will usually either get the e-mail from network scans or simple databases of e-mail addresses. Putting an effective spam filter appliance as your MX record (e.g. your own self hosted appliance, some service like MXLogic or Postini), which then forwards to your SMTP server, will do a lot more to reduce spam than making your server more obscure via DNS.

2

No, there are no security advantages to not providing an MX record. Spammers, oddly, don't care much about standards and are happy to spam right to any port 25 they find - and there are a lot of efforts out there to map open port 25s that don't depend on MX records.

0

Mail programs will use the A record if the MX record is not present. Spammer configurations will usually follow this pattern. There's no real security benefit to omitting the MX record, and probably zero spam-reduction benefit.

It would only confuse sysadmins like me. The first time I found an email domain with no MX records I was quite confused until finding the right Stack Exchange question to explain this. :-)

2
  • 1
    You are so young. In my first internet experiences, mails were sent between machines, not between domains. MX record is a new thing :-)
    – peterh
    Commented Oct 14, 2016 at 19:29
  • From my perspective MX is quite old. You must be old also. :-) Commented Oct 17, 2016 at 15:05

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .