Skip to main content
Guides/Email Security

Email Hosting: a beginner's guide

Detect email service provider

EdgeDNS Team··8 min read

What email provider is a domain actually using?

Email hosting detection is the practice of figuring out which email provider — Google Workspace, Microsoft 365, Zoho Mail, ProtonMail, Fastmail, Apple iCloud, Amazon SES, or a self-hosted setup — a particular domain is using to handle its email. The detection is almost entirely a matter of reading the MX records in DNS and recognizing the hostname patterns of the major providers. Each provider uses a distinctive set of MX hostnames: Google's MX records all end in `aspmx.l.google.com`; Microsoft 365's all match `*.mail.protection.outlook.com`; Zoho's are `mx.zoho.com`; and so on. Once you know the pattern, the provider is obvious from a single DNS query.

You should care because knowing which email provider a company uses is one of the most useful signals in B2B sales, partnerships, and migration planning. A salesperson selling email security tools wants to know whether the prospect is on Google Workspace (which has its own native security features) or Microsoft 365 (which has different ones). A consultancy planning an email migration needs to know the source platform before quoting the project. An M&A analyst doing diligence on an acquisition target wants to know whether the company is on a modern hosted provider or a legacy in-house setup. In every one of those situations, the fastest way to learn is to read the MX records.

The five things every email-hosting check looks at:

  • The MX hostnames. This is the primary signal. Each major provider has a distinct fingerprint.

  • The TXT records on the apex domain. Many providers add their own verification TXT records (`google-site-verification=...`, `MS=ms12345`, etc.) that confirm the provider.

  • The SPF includes. A `v=spf1 include:_spf.google.com -all` is unmistakable evidence of Google Workspace.

  • The DKIM selectors. Google uses `google._domainkey`, Microsoft uses `selector1._domainkey` and `selector2._domainkey`, etc.

  • The DMARC reporting addresses. Some organizations use third-party DMARC services whose addresses are recognizable.

Three questions an email-hosting check answers:

  • Which email provider is this domain currently using?

  • Has the prospect or partner I'm researching migrated recently — and if so, from where?

  • For a competitive teardown, what does the email-provider choice tell me about the company's stage and engineering culture?

The cost of guessing instead of checking is wasted sales calls, mis-scoped consulting proposals, and embarrassing pitches that misread the customer's actual stack. The fix is one DNS lookup. This is one of the cheapest pieces of intelligence available in B2B and one of the most useful for any team that needs to understand what a target company is running.

The Email Hosting endpoint, in plain language

In one sentence: Detect email service provider

Identifies the email hosting provider for a domain by analyzing MX records against 30+ known provider patterns. Detects enterprise (Google Workspace, Microsoft 365), business (Zoho, Fastmail, ProtonMail, Rackspace), transactional (SendGrid, Mailgun, Amazon SES, Postmark), security gateway (Mimecast, Proofpoint, Barracuda, Cisco), and consumer (Gmail, Yahoo, iCloud) email services. Returns provider name, vendor, service type, features, confidence level, and security gateway detection.

Don't worry if some of the words above are still unfamiliar — there's a plain-language glossary at the bottom of this page, and most of the terms link to their own beginner guides if you want to learn more.

What is actually happening when you call it

Here's what's actually happening behind the scenes when you call this endpoint:

Queries MX records via Cloudflare DoH (DNS over HTTPS) and matches mail server hostnames against a comprehensive library of 30+ email provider patterns. Sorts MX records by priority (lowest = primary), detects the primary email provider, identifies service type (enterprise/business/consumer/transactional/security), lists provider features, calculates detection confidence (high/medium/low based on primary vs backup MX match), and detects email security gateways (Mimecast, Proofpoint, Barracuda, etc.) that filter email before delivery.

If you're using an AI assistant through MCP, you don't need to understand any of the technical details — the assistant calls the tool and translates the result for you.

Why this specific tool matters

Let's skip the marketing fluff and answer the only question that actually matters: why should you, a real human with a real to-do list, care about the Email Hosting tool? Here's the plain-English version, written the way you'd hear it from a friend who happens to do this for a living.

Email provider identification is essential for sales intelligence (enterprise email = higher-value prospect), security assessments (detecting security gateways and encryption capabilities), competitive analysis (tracking provider adoption across industries), email migration planning (understanding current infrastructure), and vendor risk management (identifying organizations using consumer-grade email for business).

Picture this in real life. Imagine a sales development. Here's the situation they're walking into: Identify prospect email providers to qualify leads based on technology sophistication. Enterprise email (Google Workspace, Microsoft 365) correlates with larger, better-funded organizations. Without the right tool, that person would be stuck copy-pasting between five browser tabs, reading documentation written for engineers, and crossing their fingers that the answer they cobble together is correct. With the Email Hosting tool, the same person gets a clear answer in seconds — no spreadsheets, no guessing, no waiting for someone on the infrastructure team to free up.

Three questions this tool answers in plain English. If any of these have ever crossed your mind, the Email Hosting tool is built for you:

  • Will the emails I send actually reach the inbox, or are they going to spam?

  • Can someone else send phishing emails pretending to be my domain?

  • Have I set up the three rulebooks (SPF, DKIM, DMARC) that mailbox providers now require?

You can either click the tool and get the answer yourself, or ask your AI assistant — connected through MCP (Model Context Protocol) — to ask the question for you and translate the answer into something you can paste into Slack.

Who gets the most out of this. Small-business owners worried about deliverability, marketing managers onboarding a new email service, IT admins prepping for a security audit, and brand teams protecting against phishing. If you see yourself in that list, this is one of the EdgeDNS tools you should bookmark today.

What happens if you skip this entirely. Skip it and your real emails risk landing in the spam folder while scammers find it easier to impersonate your brand. That's why running this check — even once a month — is one of the cheapest forms of insurance you can give your domain.

Info:

Available on the free plan. The technical details: `GET /v1/domain/email-hosting`.

When would I actually use this?

If you're still on the fence about whether the Email Hosting tool belongs in your toolbox, this section is for you. Below you'll meet three real people — a sales development, a security analyst, a marketing analyst, and an IT administrator — facing three real situations where this tool turns a stressful afternoon into a five-minute task. Read whichever story sounds closest to your week.

Story 1: Sales Intelligence

Imagine you're a sales development. Identify prospect email providers to qualify leads based on technology sophistication. Enterprise email (Google Workspace, Microsoft 365) correlates with larger, better-funded organizations.

Why it matters: Prioritize prospects using enterprise email solutions for higher conversion rates.

Story 2: Security Assessment

Imagine you're a security analyst. Detect email security gateways (Mimecast, Proofpoint, Barracuda) and identify email infrastructure maturity as part of vendor or partner security assessments.

Why it matters: Assess partner email security posture without requiring access to their infrastructure.

Story 3: Competitive Intelligence

Imagine you're a marketing analyst. Analyze email provider adoption across industry verticals or competitor sets. Track migration trends from consumer to enterprise email.

Why it matters: Understand market preferences for email solutions and identify technology trends.

Story 4: Email Migration Planning

Imagine you're an IT administrator. Identify current email infrastructure before planning migration to a new provider. Detect multiple MX configurations and security gateway layers.

Why it matters: Plan email migrations with full understanding of existing infrastructure complexity.

Common situations across teams. Beyond the three stories above, here are the everyday workplace moments when people across the company reach for the Email Hosting tool — or one of the tools right next to it in this category. If any of these are on your calendar this month, that's your sign:

  • When setting up email on a brand-new domain.

  • After signing up for a new email-sending service (Mailchimp, SendGrid, HubSpot, etc.).

  • When a customer reports that your emails are landing in their spam folder.

  • Before a security audit, a SOC 2 review, or a major marketing campaign.

If you can see yourself in even one of those bullets, the Email Hosting tool will pay for itself the first time you use it.

Still not sure? Here's the easiest test in the world. Open Claude, ChatGPT, Gemini, or any other AI assistant connected to the EdgeDNS MCP server and ask, in your own words: "Is the Email Hosting tool useful for my job?" The assistant will look at the tool, ask you a couple of follow-up questions about what you're trying to accomplish, and give you a straight answer in plain English. No commitment, no signup forms, no jargon.

The easiest way: just ask your AI assistant

If you've connected the EdgeDNS MCP server to Claude, ChatGPT, Gemini, Cursor, or any other AI assistant, you don't need to write any code. Just ask in plain English:

"Use the Email Hosting tool to check example.com and explain anything that looks wrong in plain language."

The AI will figure out which tool to call, fill in the right parameters, run it, and then explain the result back to you. No copy-pasting between tabs. No reading raw JSON. No memorizing endpoint names.

Tip:

MCP (Model Context Protocol) access is free on every plan, including the free tier. One API key works for both REST and AI — you do not have to choose.

The technical way: call it from code

If you're a developer and want to call the endpoint from a script or your own application, here's the simplest possible example. Replace the placeholder API key with the real one from your dashboard.

bash
# Replace edns_live_YOUR_KEY with your real API key from the dashboard
curl -H "Authorization: Bearer edns_live_YOUR_KEY" \
  "https://api.edgedns.dev/v1/domain/email-hosting?domain=example.com"

What you need to provide

There's just one piece of information you need to provide. The table below explains exactly what it is and what a real value looks like.

FieldTypeRequired?What it meansExample

domain

string

Yes

The domain to identify email provider for

example.com

What you get back

When you call this tool, you'll get back a JSON object with the fields below. If you're talking to it through an AI assistant, the assistant reads these for you and explains them in plain language — you don't need to memorize them.

FieldTypeWhat you'll see in it

domain

string

The queried domain

hasEmail

boolean

Whether email hosting was detected

provider

string

Email provider name

mxRecords

array

MX records with host and priority (e.g. [{host: "aspmx.l.google.com", priority: 10}])

mxRecordCount

number

Number of MX records

confidence

string

Detection confidence (high, medium, low)

vendor

string

Vendor/parent company name (e.g., Google, Microsoft, Twilio)

type

string

Service type: enterprise, business, consumer, transactional, or security

features

array

Provider features (e.g., Custom Domain, Admin Console, End-to-End Encryption)

isSecurityGateway

boolean

Whether an email security gateway (Mimecast, Proofpoint, Barracuda) is in use

backupProvider

object

Backend email provider behind a security gateway (provider, vendor, type, features), or null

recommendations

array

Email hosting and security improvement suggestions

lastChecked

string

ISO 8601 timestamp of when the detection was performed

Words you might be wondering about

If any words on this page felt like jargon, here's a plain-language version. Click any linked term to read a full beginner-friendly guide.

DoH (DNS over HTTPS) — A modern way of sending DNS queries that hides them inside encrypted HTTPS traffic, so people on the same network can't see which websites you're looking up.

Need Programmatic Access?

Automate domain intelligence with 100+ API endpoints and a free MCP server for AI integration.