What it detects01
What does 'MX Unchanged Since Creation' mean?
The domain's MX records have never been changed since registration, suggesting minimal email infrastructure management.
MX Unchanged Since Domain Creation
The domain's MX records have never been changed since registration, suggesting minimal email infrastructure management.
Analyst Q&A
What this signal answers
The questions every analyst asks before acting on this signal.
Why it matters02
Why is unchanged MX a malicious signal?
Legitimate organizations typically update MX records over time. Never-changed MX indicates minimal operational investment.
How analysts use it03
How should analysts weigh this signal?
Weak malicious signal (severity 3). Use as supporting evidence alongside other indicators.
Often paired with:alert_only
Evidence shape
What MX Unchanged Since Domain Creation looks like in the response
A realistic shape of the entry the engine appends to the risk_signals array when this signal fires. Evidence keys are subgroup-default; per-signal overrides documented in the API reference.
json
{
"slug": "mx_unchanged_since_creation",
"name": "MX Unchanged Since Domain Creation",
"group": "dns_history",
"subgroup": "dns_records_mx_ns",
"direction": "malicious",
"evidence": {
"ns_provider": "cloudflare.com",
"ns_provider_tier": "paid_public",
"ns_stability_days": 412,
"mx_provider": "google.com",
"mx_provider_tier": "paid_mail"
}
}Siblings
Peers in DNS Records (MX/NS)
12 other signals share the same subgroup. They detect related behaviors and often co-fire on the same IOC.
NS Unchanged Since Domain Creation
The domain's nameserver records have never been changed since registration.
Malicious
Self-Managed Mail Infrastructure Detected
It means the domain operates its own mail exchange (MX) servers instead of relying on trusted third-party providers like…
SafeCore
Newly Self-Managed MX Server
The domain has recently set up its own mail exchange server within a short time window.
Malicious
Stable MX Usage Long Term
It shows the domain has been using the same mail exchange servers for an extended period, reflecting stable and predicta…
Safe
In the wild
See MX Unchanged Since Domain Creation fire on real IOCs
The Verdict Gallery is a curated stream of real verdicts. Filter by this signal to see exactly which IOCs it caught, what other signals fired alongside it, and what the engine recommended.
Start free, in five minutes
1,000 verdicts/month on the free tier, LLM layer included. No card required.