1

I saw on my SMTP logs that it queried a possible phishing domain, I look up on its MX records and it didn't have one. Does the domain need an MX record before sending phishing emails?

1

Does the domain need an MX record before sending phishing emails?

No. According to RFC 2821, if there is no MX record, then mail delivery will look for an A record instead:

The lookup first attempts to locate an MX record associated 
with the name.  If a CNAME record is found instead, the 
resulting name is processed as if it were the initial name.  
If no MX records are found, but an A RR is found, the A RR 
is treated as if it was associated with an implicit MX RR, 
with a preference of 0, pointing to that host.
| improve this answer | |
  • This is for the case where one would like to send an email back, provided that the return address is the same as the sender's. As for sending the original (spam) email, whatever domain as the source works (now, such emails may or may not reach the target depending on the configuration of the receiving MTA) – WoJ Dec 12 '19 at 16:42
  • While the lack of an MX record is not technically required, the days of the internet wild west where anyone could stand up a server and send email is mostly gone because common practice is to refuse federated server transfers from email servers without an MX record in order to reduce abuse. – user10216038 Dec 13 '19 at 18:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.