Skip to content

mx.endpoint.all_unreachable

No MX Endpoint Reachable

What we check

Before any SMTP dialogue, we open a TCP connection to every IP address every MX host resolves to, on port 25. This finding is emitted when none of those endpoints accepted the connection — every one refused, timed out, or had no route.

Endpoints the scanner itself has no route to (an IPv6 gap on our side) are excluded; if the only remaining endpoints all failed, the finding still fires on those.

What this finding means

The domain publishes MX records, but nothing behind them accepts mail from the public internet right now. Every sender that tries will queue the message, retry for hours or days depending on its policy, and eventually bounce it to the author. From the outside this is indistinguishable from an outage.

Because no session was established, TLS could not be tested either — the TLS category carries TLS Not Tested for the same scan.

Why it matters

How to fix

  1. Confirm from outside. From a machine not on the mail host's own network:

    dig +short MX example.com
    nc -vz -w 5 mx1.example.com 25
    
  2. Open port 25 inbound on every listed host — firewall, cloud security group, and the MTA's listener binding (inet_interfaces in Postfix).

  3. Fix DNS if the hosts no longer exist: point the MX records at the servers that actually accept mail, or publish a Null MX (MX 0 .) if the domain is not meant to receive mail at all.

  4. Re-scan once a 220 banner comes back on every endpoint.

How it's graded

A 30-point deduction in the MX category, as a fail. When only some endpoints fail, the lighter MX Endpoint Unreachable warning (−10) applies instead. See Grading Methodology.

Evidence example

mx1.example.com 192.0.2.10   connection refused
mx2.example.com 192.0.2.11   i/o timeout
→ None of the 2 MX endpoints accepted a connection on port 25

References