I have seen a rule in an environment that detects DNS MX query types going from an internal source to an external, none SMTP server. The justification states that this could be indicative of malware being used for spamming. I would like to better understand how this works, does anyone have an explanation of how this would work.

1 Answer 1


The basic idea is probably that internal clients just use the mail server of their specific mail provider which is configured in the mail user agent. Whereas spam tries to deliver directly to the MTA (mail transfer agents) of the target domain. The configured mail server does not need MX lookups (just normal A|AAAA lookups) while the delivery to target domains MTA needs MX lookups. And spamming lots of different domains thus causes lots of different MX lookups.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .