Query the recipient domain’s MX records from more than one resolver and, when possible, query the authoritative nameservers directly.
Check for:
- no expected MX answer;
- MX targets with typing errors;
- MX targets that do not resolve;
- stale cached answers after a change;
- DNSSEC validation failure;
- Null MX on a domain expected to receive mail.
Then test TCP/25 reachability to the resolved exchanger from an appropriate network.
Do not create an MX that points directly to an IP address. MX data names a host, which is then resolved separately.