A dangling MX record is a mail exchange DNS record that points to a domain or host no longer in use or no longer controlled by the organisation. It can let an attacker register the abandoned destination and receive email sent to that domain, affecting mail delivery and trust in email routing.
What makes a dangling MX record dangerous
A dangling mx record is risky because it preserves a live mail routing path to a destination the organisation no longer controls. That creates a chance for unintended message delivery, impersonation opportunities, and trust loss in email-based business processes.
The core issue is not just broken mail flow, but broken ownership assumptions. If the old target can be registered or recreated by someone else, messages intended for the original domain may be delivered to an attacker-controlled endpoint instead.
How dangling MX records arise
They usually appear during cloud migrations, domain decommissioning, rebranding, mergers, or service retirement. A host or domain is removed, but the DNS zone is not fully cleaned up, so the MX record keeps pointing at a stale destination.
This is especially common when email infrastructure is split across providers or when DNS changes are made separately from application shutdown. The DNS record can outlive the service, the hostname, or the registration that once made it legitimate.
What attackers can do with them
Once the abandoned destination becomes available, an attacker may register it, stand up a matching service, and receive mail that was never meant for them. That can expose reset links, invoices, alerts, customer correspondence, and other sensitive operational messages.
The abuse can also support social engineering. If the attacker can receive or respond to mail that appears to come from a trusted domain relationship, they may use that access to impersonate staff, intercept communications, or influence follow-up requests.
For broader DNS takeover patterns and cleanup steps, see the Subdomain Takeover Response Playbook and the Subdomain Takeover and Dangling DNS Guide.
How organisations prevent and detect it
The practical defence is ownership hygiene: maintain an accurate inventory of mail-related DNS records, verify that each MX target is still controlled, and remove records tied to retired systems or reclaimed names. That review should include outsourced mail platforms, legacy subdomains, and any hostnames used only for routing.
Detection is a combination of DNS review and external validation. Teams should compare active MX records against current registrations, confirm that destination hosts resolve to intended infrastructure, and investigate any mail routes that point to parked, expired, or unrecognised assets.
If the domain is intentionally not used for email, publish a deliberate non-mail posture rather than leaving ambiguity. The Domain Without Email guide explains how to make that intent explicit and less likely to be misread by senders or attackers.
For email routing, authentication, and related controls, the Email Security Guide provides the surrounding architecture that helps teams understand where MX records fit in the overall mail path.
Risk and Threat Considerations
A dangling MX record creates a direct confidentiality and trust risk because the message path itself can be redirected through an asset the organisation no longer owns. The result is not only missed mail, but possible exposure of sensitive correspondence and abuse of email as a trusted business channel.
Failure mechanism: The record continues to point at an abandoned mail destination after the original service, host, or domain control has ended, allowing a third party to claim the destination and receive inbound mail.
Impact: Attackers may intercept sensitive messages, impersonate a legitimate recipient or service, and exploit the trust attached to that mailbox for fraud, reset flows, or follow-on compromise.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Dangling MX records can expose mail-access material that should be rotated or revoked after takeover. |
| AC-6 — Least Privilege | A stale MX path expands unintended access to mail content beyond the intended owner. | |
| CM-8 — System Component Inventory | Detecting dangling MX records depends on an accurate inventory of mail and DNS assets. | |
| Recommendation — Rotate exposed mail credentials and revoke stale authenticators tied to abandoned mail routes. Limit mailbox and routing privileges so abandoned destinations cannot receive sensitive mail. Maintain an accurate inventory of mail-related DNS targets and retire obsolete records promptly. | ||
| NIST CSF 2.0 | ID.AM-01 — Asset Inventory | MX records are assets that must be inventoried to spot abandoned mail routing. |
| PR.DS-01 — Data-at-rest is protected | Email content exposed by a dangling MX record can include sensitive data that should be protected in transit and storage. | |
| Recommendation — Inventory mail routing assets and compare them against active DNS and registration ownership. Protect sensitive email content end to end and assume redirected mail may be exposed. | ||
Practitioner Guidance
Why practitioners should care: Treat MX records as live trust dependencies, not static DNS entries. Any mail route that outlives the system behind it can become a delivery, confidentiality, and impersonation problem rather than a harmless configuration artifact.
What to watch for: Pay attention when domains are retired, SaaS mail services are migrated, or hostnames are removed without a matching DNS clean-up. The most common failure is not malicious complexity, but incomplete decommissioning across DNS, registration, and mail operations.
Practitioner takeaway: The safest assumption is that every MX target must remain continuously owned, reachable, and intentionally used, or it should be removed.