It means the domain operates its own mail exchange (MX) servers instead of relying on trusted third-party providers like Google Workspace, Microsoft 365, or Proofpoint. Self-managed MX setups are often used by threat actors to control phishing or spam email delivery infrastructure.
The questions every analyst asks before acting on this signal.
It means the domain operates its own mail exchange (MX) servers instead of relying on trusted third-party providers like Google Workspace, Microsoft 365, or Proofpoint. Self-managed MX setups are often used by threat actors to control phishing or spam email delivery infrastructure.
Because legitimate organizations usually prefer managed email solutions that include authentication, encryption, and anti-spam protection. Self-managed MX servers offer full control but lack oversight, making them attractive for malicious email campaigns.
It indicates that the domain has recently created or switched to its own MX servers. Such sudden MX activation often precedes phishing, business email compromise (BEC), or spam campaigns, signaling a potentially malicious infrastructure setup.
A realistic shape of the entry the engine appends to the risk_signals array when this signal fires. Evidence keys are subgroup-default; per-signal overrides documented in the API reference.
{
"slug": "own_mx_usage",
"name": "Self-Managed Mail Infrastructure Detected",
"group": "dns_history",
"subgroup": "dns_records_mx_ns",
"direction": "safe",
"evidence": {
"ns_provider": "cloudflare.com",
"ns_provider_tier": "paid_public",
"ns_stability_days": 412,
"mx_provider": "google.com",
"mx_provider_tier": "paid_mail"
}
}12 other signals share the same subgroup. They detect related behaviors and often co-fire on the same IOC.
It indicates that the domain operates using its own name server infrastructure rather than a reputable third-party DNS p…
The domain has recently set up its own mail exchange server within a short time window.
It indicates that both IP and NS (nameserver) records of a domain are changing frequently, a behavior known as 'Double-F…
It indicates that the domain frequently changes its MX (Mail Exchange) records. Such behavior is often associated with s…
The Verdict Gallery is a curated stream of real verdicts. Filter by this signal to see exactly which IOCs it caught, what other signals fired alongside it, and what the engine recommended.
fairu-cdn[.]xyzSuspicious63Verified 2026-08-01bro1[.]bizSuspicious63Verified 2026-08-01cardioplus[.]com[.]mxSuspicious66Verified 2026-08-01daintybella[.]shopSuspicious63Verified 2026-08-01allium[.]topSuspicious61Verified 2026-08-01clcuahx[.]ruSuspicious64Verified 2026-08-01armadiji[.]comSuspicious61Verified 2026-08-01bideo-blog[.]xyzSuspicious63Verified 2026-08-01brandwizer[.]co[.]inSuspicious68Verified 2026-08-01ducat[.]kzSuspicious61Verified 2026-08-01centralnetro[.]com[.]brSuspicious64Verified 2026-08-01cavisaoil[.]comSuspicious61Verified 2026-08-01g3news[.]bizSuspicious62Verified 2026-08-01fiveminutes[.]bizSuspicious65Verified 2026-08-01biollet[.]comSuspicious68Verified 2026-08-01brotherpipe[.]comSuspicious61Verified 2026-08-01bayraksigorta[.]com[.]trSuspicious62Verified 2026-08-01andersonhcl[.]comSuspicious66Verified 2026-08-01filmmogzivota[.]rsSuspicious60Verified 2026-08-01fug[.]azSuspicious65Verified 2026-08-011,000 verdicts/month on the free tier, LLM layer included. No card required.