MXToolbox

MXToolbox is a workhorse DNS/MX/blacklist/SMTP diagnostics suite that email and IT admins still open in 2026 when inboxes suddenly bounce, vendors ask “are you listed?”, or a domain migration needs a second opinion. It is not our editors’ choice consumer security product, because it is not trying to be antivirus, a phishing tutor for families, or a magic deliverability guarantee. For its real audience—people who run mail and DNS—it remains highly useful.

This review is for US and UK IT generalists, MSPs, school/nonprofit admins, and developers who inherited “the email problem” and need honest scope: what free MXToolbox checks explain, what paid monitoring adds, and what only your ESP or MTA logs can tell you.

Quick verdict

MXToolbox earns 4.6 / 5 as a freemium diagnostics desk for DNS and email plumbing. Use mxtoolbox.com to inspect MX records, related DNS, blacklist status, and common SMTP/authentication-oriented checks when mail fails or a migration is in flight. Start with free tools for incident triage; consider paid monitoring if you need recurring alerts across many domains. Do not confuse a clean blacklist report with “marketing email is fixed,” and do not use MXToolbox as a substitute for SPF/DKIM/DMARC design, list hygiene, or reading bounce codes in your actual mail platform.

STA score context: durable admin utility and breadth of free checks; freemium limits, interpretation burden, and non-consumer focus keep it short of editors’ choice and a perfect 5.

What is MXToolbox?

MXToolbox is a web-based collection of network and email-related diagnostic tools—best known for MX lookups and blacklist checks—used by administrators to validate DNS configuration and investigate deliverability symptoms. Free interactive tools handle many one-off questions; paid offerings add monitoring, alerting, and workflow features for teams that outgrow paste-and-pray lookups.

Core jobs:

• Look up MX and related DNS records for a domain
• Check IP/domain reputation against public blacklists (RBLs) commonly referenced in mail troubleshooting
• Run SMTP and related tests that help explain connection or configuration failures
• Provide shareable results for tickets with registrars, ESPs, and hosting vendors
• Offer paid monitoring so problems surface before users flood the helpdesk

What it is not: an end-user antivirus, a full secure-email gateway, a replacement for Google Postmaster / Microsoft defender portals, a guarantee that ISPs will inbox your newsletter, or a one-click DMARC policy generator that understands your unique org chart. MXToolbox diagnoses infrastructure signals. Content reputation, engagement, and mailbox-provider machine learning still sit elsewhere.

Core features that matter

1. MX and DNS lookups

When mail stops, the first adult question is still “what do the MX records say?” MXToolbox makes that answer fast and shareable. You will also bounce between related record types (A/AAAA, TXT for SPF, CNAMEs that surprised you after a migration). The value is speed and a common screenshot language for junior admins who do not live in dig all day.

Always verify you queried the correct domain—apex vs send subdomain (mail., em., ESP-owned domains) is a classic footgun.

2. Blacklist checks

Blacklist (RBL) lookups are why many people know the brand. If your outbound IP appears on a list a receiving system consults, mail can defer or reject. MXToolbox aggregates checks so you are not manually visiting twenty list websites during an outage.

Interpretation rules:

• One obscure list ≠ career-ending event; prioritize lists your receivers actually use
• A listing can lag after you fix the root cause—or persist until you complete a delisting form
• Compromised form handlers, open relays, and purchased “email blast” IPs are common root causes—not MXToolbox itself

3. SMTP and authentication-oriented diagnostics

Depending on the tool you run, you can probe SMTP behavior and inspect authentication-related DNS (SPF TXT records, and pointers toward DKIM/DMARC presence). That helps answer “did we publish the SPF include the ESP told us to?” It does not automatically invent a correct DMARC rollout plan for a university with forty shadow IT senders.

4. Shareable evidence for vendor ping-pong

Email outages are often three-party disputes: you, your ESP/host, and a receiving network. MXToolbox results are a neutral-ish artifact to paste into tickets: “MX points here,” “this IP is listed there,” “SMTP test shows this banner/response.” That alone saves hours of vague Slack threads.

5. Free tools vs paid monitoring

Free tools shine for interactive incident response. Paid plans make sense when you manage many domains, want alerts when records change or listings appear, or need recurring reports for clients (MSP use case). If you check one domain twice a year, paying is optional. If email is a revenue path and you learn about listings from angry salespeople, monitoring is cheaper than surprise.

Honest scope: what MXToolbox can and cannot prove

Claim you want to make	Can MXToolbox prove it?
MX currently points to these hosts	Yes—DNS lookup snapshot
IP appears on certain public blacklists	Yes—as of that check
SPF TXT exists / roughly matches guidance	Partially—you must still validate include chains and lookup limits
Mail will land in Gmail Primary	No—provider filtering is broader than DNS
Users are safe from phishing	No—wrong product category
Your WordPress site is malware-free	No—use malware/URL tools instead
DMARC policy is “correct” for the business	No—policy is a risk decision; tools only show published records

What MXToolbox is not (read this twice)

MXToolbox will not:

• Quarantine phishing emails for end users like a secure email gateway
• Replace Microsoft 365 / Google Workspace admin alert centers
• Fix poor list hygiene, spammy copy, or purchased address lists
• Undo a domain that never deployed TLS on its submission path
• Act as consumer antivirus or a browser phishing shield

If your problem is “CEO clicked a fake invoice,” reach for mail logs, account takeover playbooks, and tools like URLScan.io or Have I Been Pwned as appropriate—not another MX lookup.

Hands-on / lab notes

Task	Result
MX lookup after DNS migration	Confirms cutover; watch TTLs before declaring victory
Blacklist check on outbound IP	Useful triage; follow delisting and root-cause steps
SPF TXT review	Catches missing ESP includes; still verify lookup count
Assume clean lists = perfect inboxing	False—content and reputation remain
Compare free one-off vs paid alert	Monitoring wins for multi-domain ops
Share result in ESP ticket	Speeds vendor response vs vibes-based complaints
Use as only DMARC strategy tool	Insufficient—need alignment reporting and sender inventory

Outage playbook that works: capture bounce codes from the sending platform → MX lookup on the recipient/sender domains as relevant → check outbound IPs on blacklists → verify SPF/DKIM/DMARC DNS → test SMTP path if connection failures → fix root cause (abuse, DNS typo, ESP misconfig) → request delisting if needed → monitor for recurrence. Do not start by rebuilding the entire mail stack because one RBL pinged red overnight.

Free vs paid without the brochure gloss

Free MXToolbox tools are enough for many small orgs’ manual diagnostics. Paid features buy time: fewer “did anyone notice the MX went missing?” moments and better MSP packaging. You still need ownership of DNS, access to the ESP, and a human who understands that blacklist delisting without killing the botnet/form spam is a temporary sugar high.

Pricing and editions

Edition	Cost	Best for
Free SuperTool / individual lookups	Free	Admins doing incident checks
Paid monitoring / higher-tier plans	Paid (see current MXToolbox plans)	MSPs, multi-domain ops, alerting
Deep ESP/MTA analytics	Outside MXToolbox	Google/Microsoft/ESP native dashboards

Pricing changes over time—verify on mxtoolbox.com. The important buying question is not “is free real?” (yes) but “do we need alerts, or only occasional lookups?”

Who should use it?

Use MXToolbox if you:

• Administer DNS and email for a business, school, nonprofit, or client base
• Need fast MX/blacklist/SMTP-oriented evidence during incidents
• Want a familiar free toolkit before escalating to vendors
• Might grow into paid monitoring across many domains

Skip or supplement if you:

• Only need consumer inbox protection / antivirus (wrong aisle)
• Expect a green checklist to guarantee marketing inbox placement
• Refuse to maintain SPF/DKIM/DMARC and sender inventory properly
• Need continuous deep analytics already provided inside your ESP

Alternatives to consider

Alternative	Best when
Native dig/nslookup + whois	You prefer CLI and already know what to query
Google Postmaster / Microsoft tools	Gmail/Microsoft reputation and authentication insights
ESP-native dashboards (SendGrid, Mailgun, etc.)	Bounce classes, streams, and vendor reputation
Dedicated DMARC platforms	Aggregate forensic/rua analysis at scale
SecurityHeaders / SSL Labs	Web/TLS hardening—not mail DNS

See the tools directory for DNS, SSL, and security utilities that sit beside mail diagnostics.

Practical week-one playbook

Day 1: Document every domain and subdomain that sends mail; note ESP vs self-hosted paths.
Day 2: Run MX and SPF/DMARC-related DNS checks; save baselines.
Day 3: Blacklist-check current outbound IPs; open delisting/root-cause tasks if needed.
Day 4: Align bounce-code runbooks with what MXToolbox can vs cannot explain.
Day 5: Decide if paid monitoring is justified for your domain count and risk.
Weekend: Remove one shadow sender (old newsletter tool, forgotten CRM) that breaks SPF alignment.

Power-user notes

Keep a change window culture for MX cuts—TTL planning beats heroics. For DMARC, move p=none → quarantine → reject only after you can read reports and cover senders. For blacklists, automate inventory of outbound IPs including cloud NAT surprises. For MSPs, standardize which MXToolbox screenshots belong in Tier-1 tickets so Tier-2 is not redoing DNS 101.

Final score: 4.6 / 5

MXToolbox remains a practical DNS/MX/blacklist/SMTP diagnostics desk for IT and email admins in 2026: strong free tooling, optional paid monitoring, and honest usefulness when mail breaks. It is not a consumer security suite and will not inbox-magically fix spammy campaigns—which is exactly why serious admins still trust it for the job it actually does.

FAQ

Is MXToolbox free?
Core lookup tools are free to use on mxtoolbox.com. Paid plans add monitoring, alerting, and team-oriented features.

Is MXToolbox an antivirus or phishing filter for users?
No. It is diagnostics for DNS/email infrastructure. End-user phishing protection lives in mail gateways, client security, and training.

What is an MX lookup?
It shows which mail servers are advertised in DNS for a domain—the first check when email routing looks wrong.

Do blacklist hits mean I am a spammer?
Not automatically. They mean a list currently associates your IP/domain with unwanted mail risk. Investigate compromise, open relays, and traffic sources; then delist if appropriate.

Free tools vs paid—what should admins buy?
Use free tools for incidents. Buy monitoring if many domains, client SLAs, or “we must know before users yell” matter.

Will MXToolbox fix deliverability by itself?
No. It helps diagnose DNS and listings. Inbox placement also depends on authentication, content, engagement, and provider policies.

MXToolbox vs ESP dashboards?
Use both. MXToolbox is great for public DNS/blacklist evidence; ESP dashboards show your streams, bounces, and vendor-specific reputation.