OSINT Radar
Email OSINT Operational

Email tools

mxtoolbox.com

MXToolbox provides DNS lookup, email header analysis, blacklist monitoring, MX record verification, and SMTP diagnostics for email investigation.

Free Open Source #Email tools #Email OSINT tools #Email OSINT resources #email #account #breach #checks #correlation #discovery #exposure
Open tool

Pivot map

You have email domain
You get accounts deliverability linked identifiers breaches credentials

Use this map to decide whether Email tools accepts the lead you are holding, and what kind of lead it may return for the next step.

Pivot from here

Outputs from Email tools can become inputs for the next tool. These are the most relevant follow-on pivots in the library.

accounts username 4 suggested tools
linked identifiers, credentials email 4 suggested tools

Investigator Use

MXToolbox (mxtoolbox.com) is a comprehensive online suite of email and DNS diagnostic tools that provides investigators with detailed information about email infrastructure, DNS records, mail server configuration, blacklist status, and network diagnostics. It is one of the most widely used tools for email infrastructure analysis and troubleshooting.


For OSINT investigators, MXToolbox's email infrastructure analysis capabilities are particularly valuable during fraud, phishing, and corporate reconnaissance investigations. The MX record lookup reveals which mail servers handle email for any domain, exposing the email infrastructure provider (Google Workspace, Microsoft 365, ProtonMail, self-hosted) and any email security services in use.


The email blacklist check simultaneously queries over 100 email reputation databases to determine whether a domain or IP address has been flagged for spam, phishing, or malware distribution. For phishing domain investigations, a comprehensive blacklist check establishes how widely the malicious domain has been detected and reported.


SPF, DKIM, and DMARC record analysis reveals the email authentication configuration of a target domain. Missing or misconfigured authentication records indicate poor email security hygiene and also provide intelligence about the likelihood of email spoofing — organizations without DMARC enforcement cannot prevent email spoofing from their domain.


DNS record lookups (A, AAAA, CNAME, TXT, NS) provide a complete picture of a domain's DNS configuration. The full DNS record set exposes hosting infrastructure, CDN usage, third-party service integrations, verification records (Google Search Console, domain ownership tokens), and sometimes internal service indicators in TXT records.


For brand protection investigations, MXToolbox's WHOIS, DNS, and blacklist data provides a rapid initial assessment of suspicious domains that may be impersonating a target brand — combining registration data, hosting patterns, and reputation scores.


MXToolbox provides free access to most tools with generous rate limits. Record all lookup results with the domain or IP queried, tool used, and query timestamp for case documentation.

Before You Pivot

Record Context

Capture the target, search terms, and why this source is relevant before you leave the page.

Preserve Evidence

Archive volatile pages, save screenshots, and keep timestamps for anything that may change.

Corroborate

Treat one tool as a lead source. Confirm important findings with independent sources.

Related tools

Related workflows