I am trying to get the SMTP of an email from the MX records. For instance, nslookup if I type in outlook.com what I get is outlook-com.olc.protection.outlook.com but actually the SMTP is smtp-mail.outlook.com. How can I get this record smtp-mail.outlook.com from the MX records rather than google for each domain what their SMTP is?
Even for 163.com the mx record I get is 163mx03.mxmail.netease.com now I have to google what is the smtp for netease.com and I figured out from internet that it is smtp.ym.163.com.
Is there a simpler or a standardised procedure to get this output? I even tried sending a mail from that email and in email header also there is no SMTP provided like this.
In any mail delivery from [email protected] to [email protected], there are generally* two SMTP servers used. The first is [email protected]’s submission server, used for a to submit mail to other people. The second is domain2.com’s destination** server, used to receive messages for domain2.com’s users. So an email goes from a’s email client to a’s submission server. The submission server relays it to domain2.com’s destination server, where b can then retrieve it.
The MX record represents the destination SMTP server, that other providers should use to send mail for that server’s users. For example, the MX for outlook.com is the SMTP server your server would use to relay messages to email addresses [email protected]. It is not the server outlook.com’s submission users use to send mail to other people.
Submission servers can theoretically be stored in DNS SRV records, but this isn’t widely deployed. Mail Clients usually guess using heuristics (try smtp and mail.domain2.com) or using databases that have been collected (eg, thunderbirds ispdb), or configured by the end user.
For example, thunderbird documents their autoconfiguration methods. It is a combination of a database, a special web server at autconfig.domain.com, admin provided configuration file, and guessing.
*: in more complicated setups, even more can be used (like internal submission and edge servers), but this is the baseline. **: this is more precisely called a relay server, I use destination as a more precise name for the final relay server.