askvity

How Does Mail DNS Work?

Published in Email Infrastructure 5 mins read

Mail DNS (Domain Name System) translates the domain name portion of an email address into an IP address, allowing email servers to route messages to the correct destination.

Here's a breakdown of how it works:

The Role of DNS in Email Delivery

Imagine sending a letter. You need the correct street address to ensure it reaches the recipient. Similarly, email needs the equivalent of a street address for the destination mail server. That's where DNS comes in. DNS provides this addressing system for email.

Key DNS Records for Email

Several types of DNS records are crucial for email delivery:

  • MX (Mail Exchange) Records: These records are the most important for email. They specify which mail servers are responsible for accepting email messages on behalf of a domain. Multiple MX records can be configured, each with a priority value. Lower numbers indicate higher priority. When sending email, the sending server will try the MX record with the lowest priority number first.

    • Example:

      example.com.  MX 10 mail.example.com.
example.com.  MX 20 mail2.example.com.

      In this example, mail.example.com is the primary mail server and mail2.example.com is the backup.

  • A Records: MX records point to a hostname (like mail.example.com). An A record maps that hostname to an IP address. This allows the sending mail server to find the actual server to connect to.

    • Example:

      mail.example.com. A 192.0.2.1

      This record maps the hostname mail.example.com to the IP address 192.0.2.1.

  • SPF (Sender Policy Framework) Records: SPF records are used to prevent email spoofing. They list the authorized mail servers that are allowed to send email on behalf of a domain. Receiving mail servers check the SPF record to verify that the sending server is authorized.

    • Example:

      example.com. TXT "v=spf1 mx a ip4:192.0.2.0/24 -all"

      This record specifies that mail servers listed in MX records, A records, and IP addresses in the 192.0.2.0/24 range are authorized to send emails for example.com. The -all at the end indicates that any mail server not listed should be rejected.

  • DKIM (DomainKeys Identified Mail) Records: DKIM adds a digital signature to outgoing email messages. Receiving mail servers can verify the signature to ensure that the message hasn't been tampered with during transit and that it was indeed sent by the claimed sender.

    • DKIM records are stored as TXT records in DNS and contain a public key.

  • DMARC (Domain-based Message Authentication, Reporting & Conformance) Records: DMARC builds upon SPF and DKIM. It allows domain owners to specify how receiving mail servers should handle messages that fail SPF or DKIM checks. It also provides reporting mechanisms so domain owners can track email authentication results.

    • Example:

      _dmarc.example.com. TXT "v=DMARC1; p=reject; rua=mailto:[email protected]"

      This record tells receiving servers to reject emails that fail SPF and DKIM checks and to send reports to [email protected].

The Email Delivery Process Using DNS:

  1. Email Composition: You compose an email and click "Send."

  2. Identifying the Recipient's Domain: Your email client extracts the domain name from the recipient's email address (e.g., @example.com).

  3. DNS Query for MX Records: Your mail server queries DNS servers for the MX records associated with example.com.

  4. Receiving MX Records: The DNS server returns a list of MX records, indicating the mail servers responsible for receiving mail for example.com, along with their priority.

  5. Resolving Hostnames to IP Addresses: Your mail server resolves the hostnames in the MX records (e.g., mail.example.com) to IP addresses using A records.

  6. Connecting to the Destination Mail Server: Your mail server attempts to connect to the mail server with the highest priority (lowest number) at the resolved IP address.

  7. Email Transfer: If a connection is established, your mail server transmits the email message to the destination mail server.

  8. SPF, DKIM, and DMARC Checks: The receiving mail server verifies SPF, DKIM, and DMARC records to authenticate the sender and prevent spam or phishing.

  9. Delivery to Inbox: If the authentication checks pass, the receiving mail server delivers the email to the recipient's inbox.

In Summary

Mail DNS is the foundation of email routing. By correctly configuring MX, A, SPF, DKIM and DMARC records, domain owners can ensure reliable email delivery and protect their domains from spoofing and phishing attacks.

Related Articles