MX Records for Cold Email: The DNS Record Everyone Skips

MX records are the DNS entry that tells the world where your domain receives mail — and on cold email sending domains, they're the record most likely to be missing. SPF gets configured because every guide covers it. DKIM gets signed because the provider forces it. MX gets skipped, because the domain was bought to send, and nobody planned for what comes back. What comes back is the reply you're paying for.

A cold email domain without working MX can still send. That's exactly what makes the problem dangerous: nothing visibly breaks, campaigns run, and the damage shows up as a reply rate that never quite makes sense.

What MX records actually do

When someone hits reply, their mail server looks up the MX (mail exchange) records on your domain to find out which server accepts mail for it. No MX record, no destination. Most servers then fall back to your domain's A record, and when that's a web server that doesn't speak SMTP for your domain — which it almost always is — the reply bounces back to your prospect as undeliverable.

Sending is the reverse path and doesn't consult MX at all, which is why a send-only domain "works." It works the way a phone that can dial out but never ring works.

Three ways a missing MX burns the domain

Replies bounce. The prospect wrote back — the outcome the entire campaign exists for — and got a delivery failure. You never see the reply, never see the failure, and mark the lead dead. On a domain sending a few hundred emails a day, even a small reply rate means real revenue disappearing into bounces.

Bounce processing breaks. Your sending tool learns about bad addresses from bounce messages returned to your domain. Without MX, those never arrive. Instantly or Smartlead shows a suspiciously clean bounce rate while you keep hammering dead addresses — the exact behavior that gets domains blacklisted. A clean-looking metric caused by broken plumbing is worse than a bad one.

Filters notice. Mailbox providers check whether the domain behind a message can itself receive mail. A domain that can't matches the profile of throwaway spam infrastructure, because that's who sends from no-MX domains at scale. It's one signal among many, but cold senders don't have spare trust to burn — and unlike reputation, this one is fixable in five minutes.

The records to add

Cold email mailboxes overwhelmingly live on Google Workspace or Microsoft 365, and each wants its own MX:

Two details worth knowing:

• Google is one record now. The old five-record set (aspmx.l.google.com and friends) still works on domains that have it, but Google moved to the single smtp.google.com record in 2023. Don't mix the two setups.
• Microsoft's value is derived from your domain — dots become dashes, so apex-outreach.com becomes apex-outreach-com.mail.protection.outlook.com. The exact host is shown in the Microsoft 365 admin center under domain setup; use what it gives you.

Remove any other MX entries while you're there. Stale records from a previous provider — a leftover registrar-parking MX, or the old provider after a migration — split delivery unpredictably, and the highest-priority record (lowest number) wins.

MX problems that look like something else

The failure is rarely "we never added MX." More often it's one of these:

• The domain-buying spree. Ten sending domains bought in one sitting, mailboxes created, SPF pasted from a checklist — and MX done on seven of the ten. The three without it perform mysteriously worse, and the diagnosis usually happens months late because campaign-level symptoms point everywhere except DNS.
• The provider switch. Mailboxes moved from Microsoft to Google (or the reverse), new MX added, old records left behind. Some replies arrive, some don't, depending on which record the sender's server picked.
• The expired domain. When a sending domain's registration lapses, its DNS — MX included — vanishes at once. If you run cold email on more than a couple of domains, renewal dates are infrastructure, not paperwork. Auto-renew everything.

After any change, send a plain test email from your personal account to a mailbox on the domain and confirm it arrives. Propagation takes minutes to a few hours.

Check every sending domain in one pass

Auth records get all the attention, but a sending domain needs the full set: SPF, DKIM, DMARC (the 15-minute setup), MX, a clean blacklist record, and enough warmup age to be trusted. The free deliverability checker tests all of it in one pass — including MX and domain expiry — and when something fails, it shows the exact record to paste into Cloudflare, GoDaddy, or Namecheap.

For agencies, the harder version of this problem is scale: thirty client domains, any of which can lose MX to a well-meaning DNS edit next Tuesday. ColdOps re-checks MX, auth, blacklists, and expiry on every client sending domain daily and raises an issue the day one breaks — before a week of bounced replies explains itself in the monthly report.

Five minutes per domain. Check the ones you're sending from today; the reply you save this week has already paid for it.