# Reverse MX API URL: https://www.deepinfo.com/data-api/apis/reverse-mx/ ## Find Every Domain That Routes Mail Through One Server. The Reverse MX API takes an MX hostname and returns the domains whose MX records name it, each as a full domain record. Set `apex=true` and the match widens to all mail hosts under that domain, so `mx1` and `mx2` count together. [Talk to us about access](https://www.deepinfo.com/contact/?topic=data-api) [Reverse MX reference](https://docs.deepinfo.com/reference/discovery/reverse-mx/) ### Three Domains Share One Private Mail Pool. Mail servers an organization runs itself are a strong ownership signal. Domains that share private mail hosts often belong to one group. GET `https://api.deepinfo.com/v1/discovery/reverse-mx` [Reference](https://docs.deepinfo.com/reference/discovery/reverse-mx/) | Parameter | Type | | Description | | --- | --- | --- | --- | | `mx` | string | Required | An MX hostname, for example `mx1.acme.example`. | | `apex` | boolean | Optional | Match every mail host under the same registered domain. Default `false`. | | `include_subdomains` | boolean | Optional | Include matching subdomains as well. Default `false`. | | `page` | integer | Optional | Page number, from 1. | | `page_size` | integer | Optional | Results per page. | | `ordering` | string | Optional | Field to sort by. Prefix `-` for descending. | | `export` | boolean | Optional | Return the result as an export instead of a page. Default `false`. | | `export_format` | string | Optional | `json` or `csv`. | | `export_scope` | string | Optional | How much of each record to include: `basic`, `default` or `extended`. | Request curl: ```bash curl "https://api.deepinfo.com/v1/discovery/reverse-mx?mx=mx1.acme.example&apex=true&page_size=25" \ -H "apikey: YOUR_API_KEY" ``` Python: ```python import requests r = requests.get( "https://api.deepinfo.com/v1/discovery/reverse-mx", params={"mx": "mx1.acme.example", "apex": "true", "page_size": 25}, headers={"apikey": "YOUR_API_KEY"}, ) data = r.json() print(data["result_count"]) for d in data["results"]: print(d["punycode"], d["dns"]["mx"]["mail_servers"]) ``` JavaScript: ```javascript const r = await fetch( 'https://api.deepinfo.com/v1/discovery/reverse-mx?mx=mx1.acme.example&apex=true&page_size=25', { headers: { apikey: 'YOUR_API_KEY' } } ) const { result_count, results } = await r.json() console.log(result_count, results.map((d) => d.punycode)) ``` Response 200 OK · application/json ```json { "page": 1, "page_size": 25, "result_count": 3, "results": [ { "punycode": "acme.example", "unicode": "acme.example", "is_idn": false, "dns": { "mx": { "update_date": "2026-09-20T06:12:44Z", "mail_servers": ["mx1.acme.example", "mx2.acme.example"] } } }, { "punycode": "acme-group.example", "unicode": "acme-group.example", "is_idn": false, "dns": { "mx": { "mail_servers": ["mx2.acme.example"] } } }, { "punycode": "acme-careers.example", "unicode": "acme-careers.example", "is_idn": false, "dns": { "mx": { "mail_servers": ["mx1.acme.example"] } } } ] } ``` ### Match One Host or the Whole Mail Domain. Without `apex`, the match is the hostname you pass. With `apex=true`, it covers all mail hosts under that hostname’s registered domain, which also catches the domains pointed at a different server in that pool. Hosted mail providers serve very large numbers of unrelated domains, so a lookup on their servers says little about ownership. Reverse MX is most useful on mail servers an organization runs itself. ### Where Mail Infrastructure Gives Owners Away. #### [Subsidiary Oversight](https://www.deepinfo.com/solutions/use-cases/subsidiary-oversight/) List the group-company domains that deliver to your central mail servers, including the ones nobody registered centrally. #### [Phishing Detection](https://www.deepinfo.com/solutions/use-cases/phishing-detection-and-prevention/) When a look-alike domain points its MX at an unfamiliar server, list the other domains that server receives mail for. #### [Threat Hunting](https://www.deepinfo.com/solutions/use-cases/threat-hunting/) Cluster suspect domains by the mail infrastructure they share, then read each record for registration dates and certificates. #### [M&A Due Diligence](https://www.deepinfo.com/solutions/use-cases/mergers-acquisitions-due-diligence/) Find the domains that run on a target’s mail servers, beyond the list the target hands over. ### What Goes In and What Comes Back. - **Input**: The MX hostname as it appears in DNS, without the priority value. - **In each result**: `dns.mx.mail_servers` holds the domain’s full MX list, with its `update_date`. - **Totals**: `result_count` is the total number of matches across all pages. See [pagination](https://docs.deepinfo.com/getting-started/pagination/). - **Rate limits**: Plan-dependent. The default is one request per second per key and endpoint. See [rate limits](https://docs.deepinfo.com/getting-started/rate-limits/). ### Pivot on the Next Signal. - [Reverse IP](https://www.deepinfo.com/data-api/apis/reverse-ip/) (Discovery): Domains on an address, or on its whole network. - [Reverse NS](https://www.deepinfo.com/data-api/apis/reverse-ns/) (Discovery): Domains that use a given name server. - [Associated Domain Finder](https://www.deepinfo.com/data-api/apis/associated-domain-finder/) (Discovery): Mail servers, name servers, IP and registrant signals from one seed. ### See This Data at Work in the Deepinfo Platform External Attack Surface Management runs these lookups continuously over your assets and raises what changes as issues, and Deep Search & Insights opens the whole index to your analysts. - [External Attack Surface Management](https://www.deepinfo.com/platform/easm/) (EASM) - [Deep Search & Insights](https://www.deepinfo.com/platform/dsi/) (DSI) - [How the Platform Works](https://www.deepinfo.com/platform/how-it-works/) ### Questions About Reverse MX API **Can we sort the result, for example by expiry date?** Yes. `ordering=domain.whois.expiry_date` lists the earliest expiry first, and a `-` prefix lists the latest first. **Can we combine a mail server with other conditions?** Yes, in [Domain Search](https://www.deepinfo.com/data-api/apis/domain-search/). Filter `dns.mx.mail_servers` together with a registration date, a registrant or a name keyword in one body. **Can we pivot on a mail server a domain used before?** Yes. [DNS History](https://www.deepinfo.com/data-api/apis/dns-history/) with `type=MX` lists each mail server a domain has had, with the times it was seen. Pass an older one here to see which domains in the index use it. **How is the Reverse MX API priced?** As part of an API services plan, priced by volume and frequency, separately from the Deepinfo Platform. See [Data & API pricing](https://www.deepinfo.com/pricing/#data-pricing). **Can analysts run this pivot without writing code?** Yes. Deep Search & Insights runs Reverse MX and the other pivots in the Deepinfo Platform. See [Domain Search](https://www.deepinfo.com/platform/dsi/domain-search/). ### Start From Your Mail Servers. Run Reverse MX on the mail hosts your group operates and see which domains deliver to them. We set up access on a short call. [Talk to us about access](https://www.deepinfo.com/contact/?topic=data-api) [All API services](https://www.deepinfo.com/data-api/apis/)