Request demo

Reverse MX API

Find Every Domain That Routes Mail Through One Server.

The Reverse MX API takes an MX hostname and returns the domains whose MX records name it, each as a full domain record. Set apex=true and the match widens to all mail hosts under that domain, so mx1 and mx2 count together.

Talk to us about access Reverse MX reference

mail server mx1.acme.example same pool as mx2.acme.example

  1. exact · mx=mx1.acme.example
    • acme.examplemx1, mx2
    • acme-careers.examplemx1
  2. apex=true
    • acme-group.examplemx2 only

Three Domains Share One Private Mail Pool.

Mail servers an organization runs itself are a strong ownership signal. Domains that share private mail hosts often belong to one group.

GET https://api.deepinfo.com/v1/discovery/reverse-mx Reference
ParameterTypeDescription
mxstringRequiredAn MX hostname, for example mx1.acme.example.
apexbooleanOptionalMatch every mail host under the same registered domain. Default false.
include_subdomainsbooleanOptionalInclude matching subdomains as well. Default false.
pageintegerOptionalPage number, from 1.
page_sizeintegerOptionalResults per page.
orderingstringOptionalField to sort by. Prefix - for descending.
exportbooleanOptionalReturn the result as an export instead of a page. Default false.
export_formatstringOptionaljson or csv.
export_scopestringOptionalHow much of each record to include: basic, default or extended.

Request

curl "https://api.deepinfo.com/v1/discovery/reverse-mx?mx=mx1.acme.example&apex=true&page_size=25" \
  -H "apikey: YOUR_API_KEY"

Response

200 OK · application/json 
{
  "page": 1,
  "page_size": 25,
  "result_count": 3,
  "results": [
    {
      "punycode": "acme.example",
      "unicode": "acme.example",
      "is_idn": false,
      "dns": {
        "mx": {
          "update_date": "2026-09-20T06:12:44Z",
          "mail_servers": ["mx1.acme.example", "mx2.acme.example"]
        }
      }
    },
    {
      "punycode": "acme-group.example",
      "unicode": "acme-group.example",
      "is_idn": false,
      "dns": {
        "mx": { "mail_servers": ["mx2.acme.example"] }
      }
    },
    {
      "punycode": "acme-careers.example",
      "unicode": "acme-careers.example",
      "is_idn": false,
      "dns": {
        "mx": { "mail_servers": ["mx1.acme.example"] }
      }
    }
  ]
}

Match One Host or the Whole Mail Domain.

Without apex, the match is the hostname you pass. With apex=true, it covers all mail hosts under that hostname’s registered domain, which also catches the domains pointed at a different server in that pool.

Hosted mail providers serve very large numbers of unrelated domains, so a lookup on their servers says little about ownership. Reverse MX is most useful on mail servers an organization runs itself.

Domain

Its MX hosts

acme-careers.exampleexact

acme.exampleexact

acme-group.exampleapex=true

mx1.acme.example

mx2.acme.example

apex=true

mx=mx1.acme.example · exact: the domains whose MX records name it apex=true · every mail host under acme.example

Where Mail Infrastructure Gives Owners Away.

Subsidiary Oversight

List the group-company domains that deliver to your central mail servers, including the ones nobody registered centrally.

Use case

Phishing Detection

When a look-alike domain points its MX at an unfamiliar server, list the other domains that server receives mail for.

Use case

Threat Hunting

Cluster suspect domains by the mail infrastructure they share, then read each record for registration dates and certificates.

Use case

M&A Due Diligence

Find the domains that run on a target’s mail servers, beyond the list the target hands over.

Use case

What Goes In and What Comes Back.

InputThe MX hostname as it appears in DNS, without the priority value.
In each resultdns.mx.mail_servers holds the domain’s full MX list, with its update_date.
Totalsresult_count is the total number of matches across all pages. See pagination.
Rate limitsPlan-dependent. The default is one request per second per key and endpoint. See rate limits.

Pivot on the Next Signal.

Discovery Reverse IP Domains on an address, or on its whole network. Read Discovery Reverse NS Domains that use a given name server. Read Discovery Associated Domain Finder Mail servers, name servers, IP and registrant signals from one seed. Read

See This Data at Work in the Deepinfo Platform

External Attack Surface Management runs these lookups continuously over your assets and raises what changes as issues, and Deep Search & Insights opens the whole index to your analysts.

Questions About Reverse MX API

Can we sort the result, for example by expiry date?

Yes. ordering=domain.whois.expiry_date lists the earliest expiry first, and a - prefix lists the latest first.

Can we combine a mail server with other conditions?

Yes, in Domain Search. Filter dns.mx.mail_servers together with a registration date, a registrant or a name keyword in one body.

Can we pivot on a mail server a domain used before?

Yes. DNS History with type=MX lists each mail server a domain has had, with the times it was seen. Pass an older one here to see which domains in the index use it.

How is the Reverse MX API priced?

As part of an API services plan, priced by volume and frequency, separately from the Deepinfo Platform. See Data & API pricing.

Can analysts run this pivot without writing code?

Yes. Deep Search & Insights runs Reverse MX and the other pivots in the Deepinfo Platform. See Domain Search.

Start From Your Mail Servers.

Run Reverse MX on the mail hosts your group operates and see which domains deliver to them. We set up access on a short call.

Talk to us about access All API services