Email · appears in CAIQ, SIG
Does the domain publish valid MX records for inbound mail handling?
MX records direct inbound mail. Misconfiguration silently breaks email delivery and lets attackers stand up parallel MX hosts for spoofing campaigns (ISO 27001 A.8.21).
How to answer this
Whichever verdict your domain earns, this is the wording to put in the response box. Reviewers mark an answer down for vagueness more often than for a "No", so say which state you are in and what evidences it.
- Yes
- MX records are published and resolve to valid mail exchangers
- Partial
- MX records are published but with warnings
- No
- No MX records were found for this domain
Controls this evidences
| Framework | Control | Why it maps |
|---|---|---|
| SOC 2 | CC6.7 | Mail-server topology is part of inbound boundary documentation. |
| ISO 27001 | A.8.21 | — |
| NIST 800-53 | SC-8 | — |
Domain Posture is not an audit and does not replace an auditor. See methodology v1 for how each verdict is reached.
When a "Yes" stops being true
MX records removed or no longer resolve to a valid mail exchanger.
That is the whole problem with answering a questionnaire from a screenshot: the answer was true the day you took it. A signed evidence pack is dated, and a schedule re-checks it so you find out before your reviewer does.