mx.endpoint.unreachable
MX Endpoint Unreachable
What we check
Before any SMTP dialogue, we open a TCP connection to every IP address every MX host resolves to, on port 25. This finding is emitted when the TCP handshake with at least one of those endpoints never completed — connection refused, connect timeout, or no route — while at least one other endpoint accepted a connection.
A server that accepted the connection and then refused the session or never sent a greeting (a 4xx greeting, an EHLO rejection, a silent stall) is a different situation and is reported as SMTP Session Not Established, which is not scored — the MX table shows "No SMTP greeting" there, not "Connection timed out". Endpoints the scanner itself has no route to (an IPv6 gap on our side) are excluded from both counts and shown as "not probed".
What this finding means
Part of the domain's published mail infrastructure is dead from the public internet. Every sending server that picks that endpoint first — MX preference and then random choice among equal-preference hosts decides — waits for the connection to fail before trying the next one. Mail still arrives via the working endpoints, but with delays, and the dead endpoint is a sign that either the DNS or the host is not being maintained.
The finding lists each failed endpoint with the reason the operating system reported, so you can tell a firewall (connection refused) from a black hole (connect timeout).
Why it matters
- Delayed delivery. Senders retry the dead endpoint on every attempt; a 30-second connect timeout per message per sender adds up.
- Reduced redundancy. A second MX host that does not answer is no backup at all — the domain is one outage away from bouncing mail.
- Stale records. Unreachable endpoints usually mean a decommissioned host still in DNS, or a new AAAA record for a host whose firewall only allows IPv4.
How to fix
Identify the endpoint. The finding names the MX host and the exact IP. Check whether that address is still supposed to serve mail.
Fix or remove. Either open port 25 on that host from the public internet (firewall, security group, listener binding — check both IPv4 and IPv6 if the host has an AAAA record), or remove the address from DNS.
Verify:
nc -vz -w 5 mx2.example.com 25 nc -6 -vz -w 5 mx2.example.com 25 # if the host has an AAAA record
How it's graded
A 10-point deduction in the MX category as a warning, regardless of how many endpoints failed. When no endpoint accepts a connection, the finding becomes No MX Endpoint Reachable instead (−30). See Grading Methodology.
Evidence example
mx1.example.com 192.0.2.10 220 mx1.example.com ESMTP
mx2.example.com 192.0.2.11 connection refused
mx2.example.com 2001:db8::11 i/o timeout
→ 2 of 3 MX endpoints did not accept a connection on port 25