It means the domain operates its own mail exchange (MX) servers instead of relying on trusted third-party providers like Google Workspace, Microsoft 365, or Proofpoint. Self-managed MX setups are often used by threat actors to control phishing or spam email delivery infrastructure.
Three questions every analyst asks before acting on this signal.
It means the domain operates its own mail exchange (MX) servers instead of relying on trusted third-party providers like Google Workspace, Microsoft 365, or Proofpoint. Self-managed MX setups are often used by threat actors to control phishing or spam email delivery infrastructure.
Because legitimate organizations usually prefer managed email solutions that include authentication, encryption, and anti-spam protection. Self-managed MX servers offer full control but lack oversight, making them attractive for malicious email campaigns.
It indicates that the domain has recently created or switched to its own MX servers. Such sudden MX activation often precedes phishing, business email compromise (BEC), or spam campaigns, signaling a potentially malicious infrastructure setup.
A realistic shape of the entry the engine appends to the risk_signals array when this signal fires. Evidence keys are subgroup-default; per-signal overrides documented in the API reference.
{
"slug": "own_mx_usage",
"name": "Self-Managed Mail Infrastructure Detected",
"group": "dns_history",
"subgroup": "dns_records_mx_ns",
"direction": "malicious",
"evidence": {
"ns_provider": "cloudflare.com",
"ns_provider_tier": "paid_public",
"ns_stability_days": 412,
"mx_provider": "google.com",
"mx_provider_tier": "paid_mail"
}
}8 other signals share the same subgroup. They detect related behaviors and often co-fire on the same IOC.
It indicates that the domain operates using its own name server infrastructure rather than a reputable third-party DNS p…
It indicates that both IP and NS (nameserver) records of a domain are changing frequently, a behavior known as 'Double-F…
It indicates that the domain frequently changes its MX (Mail Exchange) records. Such behavior is often associated with s…
It shows the domain has been using the same mail exchange servers for an extended period, reflecting stable and predicta…
The Verdict Gallery is a curated stream of real verdicts. Filter by this signal to see exactly which IOCs it caught, what other signals fired alongside it, and what the engine recommended.
100 IOCs/day on the free tier, LLM layer included. No card required.