Email tools

MXToolbox (mxtoolbox.com) is a comprehensive online suite of email and DNS diagnostic tools that provides investigators with detailed information about email infrastructure, DNS records, mail server configuration, blacklist status, and network diagnostics. It is one of the most widely used tools for email infrastructure analysis and troubleshooting.

For OSINT investigators, MXToolbox's email infrastructure analysis capabilities are particularly valuable during fraud, phishing, and corporate reconnaissance investigations. The MX record lookup reveals which mail servers handle email for any domain, exposing the email infrastructure provider (Google Workspace, Microsoft 365, ProtonMail, self-hosted) and any email security services in use.

The email blacklist check simultaneously queries over 100 email reputation databases to determine whether a domain or IP address has been flagged for spam, phishing, or malware distribution. For phishing domain investigations, a comprehensive blacklist check establishes how widely the malicious domain has been detected and reported.

SPF, DKIM, and DMARC record analysis reveals the email authentication configuration of a target domain. Missing or misconfigured authentication records indicate poor email security hygiene and also provide intelligence about the likelihood of email spoofing — organizations without DMARC enforcement cannot prevent email spoofing from their domain.

DNS record lookups (A, AAAA, CNAME, TXT, NS) provide a complete picture of a domain's DNS configuration. The full DNS record set exposes hosting infrastructure, CDN usage, third-party service integrations, verification records (Google Search Console, domain ownership tokens), and sometimes internal service indicators in TXT records.

For brand protection investigations, MXToolbox's WHOIS, DNS, and blacklist data provides a rapid initial assessment of suspicious domains that may be impersonating a target brand — combining registration data, hosting patterns, and reputation scores.

MXToolbox provides free access to most tools with generous rate limits. Record all lookup results with the domain or IP queried, tool used, and query timestamp for case documentation.