MX hosts resolve to public addresses

An MX record names a host; delivery needs an address. This check resolves every MX target to its A and AAAA records and classifies what comes back, because a target that does not resolve — or resolves somewhere unreachable — is a mail route that does not exist, however correct the MX record looks.

A target with no address is a dead route. A sender works down the preference list, so one dead entry among several costs a connection attempt and a timeout on every delivery rather than a bounce. If every entry is dead, mail queues on the sending side for a few days and then bounces in bulk, long after the change that broke it.

A target resolving to a private or reserved address is worse than dead, because it looks configured. It is unreachable from the internet by definition, and it is nearly always an internal record that escaped into the public zone — which also tells anyone who asks how your network is laid out.

For a target with no address, decide whether the host should exist. If it should, publish its A and AAAA records; if it should not, remove the MX record, because a stale entry for a decommissioned server is pure cost on every delivery attempt.

For a private address, look at how the zone is published rather than at the record. A single zone served to both an internal and an external audience will put it back the next time somebody edits the internal side; separate views are the fix.

Check the AAAA records as carefully as the A records. A mail server whose AAAA points somewhere that does not answer fails for exactly the senders that are IPv6-capable and prefer it — a growing subset, and a fault that presents as "only some senders can reach us".