Before your cold email reaches a prospect, it passes through exactly one gatekeeper: the mail server listed in their domain's MX record. That server decides whether your message lands in the inbox, the junk folder, or a quarantine queue nobody checks. Most SDRs never look at it. That is a mistake, because the lookup is free, takes one second, and changes how you should write, send, and measure.
We run a daily DNS scan of the Tranco top-1M domains, built on OpenINTEL data going back to 2016. As of the 2026-07-05 snapshot, 664,715 of those domains publish an MX record — and the distribution of who actually answers on the other end is remarkably concentrated: 21.75% route to Google Workspace, 16.68% to Microsoft 365, and 22.53% still run self-hosted mail servers. Learn to read those three answers and you understand the filter in front of six out of ten prospects.
The one-command lookup
On any machine with dig (macOS, Linux, WSL), query the MX record of the prospect's email domain:
$ dig +short MX prospect-company.com
1 aspmx.l.google.com.
5 alt1.aspmx.l.google.com.
10 alt3.aspmx.l.google.com.The number in front is the preference — lower wins. The hostname with the lowest preference is the primary MX, and that is the server (and the filtering stack) your email will actually meet. On Windows without WSL, nslookup -type=mx prospect-company.com does the same job. That is the whole technique. The skill is in reading the answer.
What a million domains answer
Here is the ten-year trajectory of the three biggest categories, from 192 snapshots between January 2016 and July 2026:
Self-hosted mail has fallen from 42.76% in 2016 to 22.53% today, while the Google/Microsoft duopoly now covers 38.4% of domains. The practical consequence for outbound: the era when every domain hid a differently configured, unpredictable filter is ending. Two filtering stacks now dominate — and each can be studied.
Reading the answer: an MX-to-filter cheat sheet
| Primary MX contains | Provider | What judges your email |
|---|---|---|
aspmx.l.google.com | Google Workspace (21.75%) | Gmail spam filtering — engagement-driven, domain-reputation heavy |
mail.protection.outlook.com | Microsoft 365 (16.68%) | Exchange Online Protection — SCL scoring, IP and tenant reputation |
pphosted.com | Proofpoint (1.91%) | Enterprise gateway: reputation scoring plus URL sandboxing |
mimecast.com | Mimecast (1.53%) | Enterprise gateway: policy engine plus link rewriting |
mx.cloudflare.net | Cloudflare Email Routing (1.60%) | Forwarding to a personal mailbox — often a founder reading directly |
The domain itself (mail.prospect.com) | Self-hosted (22.53%) | Whatever the admin installed — SpamAssassin, rspamd, appliance, or nothing |
A long tail remains: as of the same snapshot, 12.45% of domains resolve to MX hosts our 310+ classification patterns cannot attribute — regional hosters, appliances, one-off setups. If the hostname looks unfamiliar, it probably is; treat it conservatively.
What to change once you know the provider
- Google Workspace prospects. Gmail's filter weighs engagement history with your sending domain heavily. Warm domains, low complaint rates, and consistent volume matter more than any single email's wording. Expect Promotions-style categorisation for template-heavy HTML.
- Microsoft 365 prospects. Exchange Online Protection leans on IP reputation and tenant-level block lists. A single admin marking you as spam can suppress you for the whole organisation. Keep per-tenant volume low and spread sends across time.
- Security gateways. Proofpoint and Mimecast rewrite and sandbox your links, so click tracking will show phantom clicks from scanners. Strip trackers, avoid attachments, and read our gateway-specific playbook before touching enterprise lists.
- Self-hosted. No two setups behave alike. Plain-text emails, modest volume, and fast bounce monitoring are your safest defaults. Some of these servers run no filtering at all; others reject anything without a perfect SPF/DKIM/DMARC setup.
Batch it before the campaign
Checking one domain is a party trick; checking your whole list is a process. Extract the unique domains from your prospect list, resolve MX for each (a shell loop over dig +short MX handles thousands per hour, respecting your resolver), and tag every contact with a provider bucket. Then split sequences by bucket — reply and placement behaviour differ enough that a single undifferentiated blast wastes your best prospects. Our segmentation guide covers the workflow end to end.
The provider shares above move every day. The daily email infrastructure report publishes the current MX-provider breakdown of the Tranco top-1M, with per-provider trend lines and a machine-readable JSON feed.
One caveat: the MX record tells you who will judge your email, not the verdict. Two senders hitting the same Google Workspace domain can land in opposite folders because their own domain reputation differs. So after segmenting by provider, close the loop — send a test to seed mailboxes at each provider you target and see where you actually land before the real sequence goes out.