mx.all_targets_ip_literal
All MX Targets Are IP Literals
What we check
We check whether every real MX target (Null MX records are excluded) is an IP address literal rather than a hostname. A single IP literal MX is reported as mx.ip_literal; this finding fires when all targets are literals, leaving no valid hostname target for the domain.
What this finding means
Every MX record for the domain points to an IP address literal instead of a hostname. The domain effectively has no hostname-based mail routing — the same practical result as having no MX records at all. While some sending servers may attempt delivery to the literal addresses, this configuration is a complete violation of RFC 5321 §5.1.
Why it matters
- Equivalent to no MX. Without hostname targets, the domain cannot participate in any hostname-based mail security mechanism — TLS certificate verification, DANE, MTA-STS all fail.
- Delivery at risk. Strict sending implementations may refuse to deliver to IP literal targets entirely.
- Instant F grade. This finding is treated with the same severity as missing MX records because the practical effect is identical: the domain has no valid mail routing.
How to fix
Replace all IP literal MX targets with hostnames:
; Before (wrong) example.com. IN MX 10 [192.0.2.1] example.com. IN MX 20 [192.0.2.2] ; After (correct) example.com. IN MX 10 mail.example.com. example.com. IN MX 20 mail2.example.com.Create A/AAAA records for the new hostnames pointing to the mail server IPs.
How it's graded
All-literal MX targets trigger an instant F grade for the MX category — no separate point deduction, the category is immediately failed. See Grading Methodology for the full scoring model.
Evidence example
$ dig +short MX example.com
10 [192.0.2.1]
20 [198.51.100.1]
Every MX target is an IP literal — no hostname-based mail routing exists