mx.endpoint.all_unreachable
No MX Endpoint Reachable
What we check
Before any SMTP dialogue, we open a TCP connection to every IP address every MX host resolves to, on port 25. This finding is emitted when none of those endpoints accepted the connection — every one refused, timed out, or had no route.
Endpoints the scanner itself has no route to (an IPv6 gap on our side) are excluded; if the only remaining endpoints all failed, the finding still fires on those.
What this finding means
The domain publishes MX records, but nothing behind them accepts mail from the public internet right now. Every sender that tries will queue the message, retry for hours or days depending on its policy, and eventually bounce it to the author. From the outside this is indistinguishable from an outage.
Because no session was established, TLS could not be tested either — the TLS category carries TLS Not Tested for the same scan.
Why it matters
- Mail is not being received. Not delayed — refused at the network layer. Senders' queues fill and bounce.
- Deliverability signal. Large providers track connect failures per domain; a domain that is dark for a while may be deprioritised after it comes back.
- Usually simple causes. A firewall rule, a security group missing port 25, a host that was decommissioned while its DNS stayed, or a provider migration that moved the service but not the records.
How to fix
Confirm from outside. From a machine not on the mail host's own network:
dig +short MX example.com nc -vz -w 5 mx1.example.com 25Open port 25 inbound on every listed host — firewall, cloud security group, and the MTA's listener binding (
inet_interfacesin Postfix).Fix DNS if the hosts no longer exist: point the MX records at the servers that actually accept mail, or publish a Null MX (
MX 0 .) if the domain is not meant to receive mail at all.Re-scan once a
220banner comes back on every endpoint.
How it's graded
A 30-point deduction in the MX category, as a fail. When only some endpoints fail, the lighter MX Endpoint Unreachable warning (−10) applies instead. See Grading Methodology.
Evidence example
mx1.example.com 192.0.2.10 connection refused
mx2.example.com 192.0.2.11 i/o timeout
→ None of the 2 MX endpoints accepted a connection on port 25