The MX that changes everything

After this lesson you can

Explain why an MX record on a lookalike is the single strongest escalation signal.

Assumes you have read Reuse across a set.

Of every signal available on a lookalike domain, one changes the assessment more than any other: the presence of an MX record. A domain that can receive mail has been prepared for a conversation, not a landing page.

Why it matters so much

It is deliberate and costs effort. Parking and monetisation need no MX. Nobody configures mail by accident.
It enables the expensive attack. Credential phishing needs a web page. Invoice redirection needs a mailbox that can receive the reply — and that is the attack with the largest per-incident loss.
It implies a targeted campaign. Mass phishing sends and does not read. A conversational attack against a named finance team needs to receive.
It is trivially checkable and routinely not checked.

The check

dig +short MX suspicious-lookalike.example

Empty        -> web-only, or not yet prepared
Any answer   -> escalate. Someone intends to receive mail
                as a name resembling yours.

Where it sits against everything else

Signal	Weight
MX present	Highest. Deliberate, effortful, enables the costliest attack.
Certificate issued	High. Imminent use, usually within hours.
Cloned content served	High, and it is already active — you are late.
A record resolving	Moderate. Preparation.
Registered in the last 30 days	Moderate. Common to most phishing and most nothing.
Privacy-protected registrant	None. It is the default.

MX plus certificate is the pair to alert on

Either alone deserves attention. Both on the same domain means somebody has prepared to serve a site and receive replies, which is a complete phishing operation and is worth waking someone for. It is also a simple rule that fits in one line of a monitoring configuration.

Knowledge check

Two lookalikes are found. One serves a cloned login page. One has no content and an MX record. Which is more urgent?

Both are urgent, and the MX one is the more dangerous — mail receipt enables invoice redirection, which has the largest per-incident loss.
The cloned page, because it is already live and the other is not.
The MX one only — a cloned page without a certificate deceives nobody.
Neither, until content appears on the second.

Correct — Both are urgent, and the MX one is the more dangerous — mail receipt enables invoice redirection, which has the largest per-incident loss. The clone is active and mostly harvests credentials at volume. The MX domain is prepared for a targeted conversation with a named finance team, and one successful payment diversion exceeds the cost of an entire credential campaign.

Not this — The cloned page, because it is already live and the other is not. Being live makes it immediate. It does not make it the larger loss, and the MX domain being quiet is a preparation stage rather than an absence of intent.

Not this — The MX one only — a cloned page without a certificate deceives nobody. A cloned page serving over HTTPS deceives plenty of people, and it is already operating.

Not this — Neither, until content appears on the second. Waiting for content on a domain configured to receive mail forfeits the only warning you were given.

Last reviewed 2026-09-15