Email Provider Filter

What Is an Email Provider?

An email provider is the service that handles incoming and outgoing mail for a domain. When you send an email to someone@example.com, your mail server looks up the MX records for example.com to determine where to deliver the message. Those MX records point to the provider's mail servers — for example, Google's servers, Microsoft's Outlook servers, or Zoho's servers.

Knowing which provider a domain uses is useful for sales teams, IT administrators, security researchers, and anyone who needs to understand a domain's email infrastructure.

What the Email Provider Filter Does

The Email Provider Filter takes a list of email addresses (up to 500 at a time) and determines which mail provider each domain uses. It does this by:

• Checking email syntax — verifying each address is structurally valid before processing.
• Looking up MX records — querying DNS for the mail exchange records of each unique domain.
• Looking up SPF records — checking the Sender Policy Framework TXT records, which often reveal the true provider even when a filtering service handles MX.
• Matching against provider signatures — comparing the DNS results against known signatures for 26+ providers, including Google, Microsoft, Yahoo, Zoho, ProtonMail, Amazon SES, Mailgun, SendGrid, and more.
• Sorting by provider — grouping all valid emails by their detected provider for easy export.

How to Check a Domain's Email Provider

1. Paste your email addresses into the tool or upload a .txt/.csv file.
2. Click "Validate & Sort" to start the analysis.
3. Review the results — valid emails are grouped by provider, invalid emails are listed separately.
4. Copy or download the sorted results (joining the Telegram channel unlocks export).

What Information Can Be Detected

The tool detects the following for each email domain:

• Mail provider — the named service (Google, Microsoft, Zoho, etc.)
• Match method — whether the provider was identified via MX records, SPF records, or verification tokens
• Validity — whether the domain has valid MX records and can receive email
• Invalid addresses — emails that failed syntax validation or whose domains lack MX records

How MX and DNS Information Relates to Email Providers

MX (Mail Exchange) records are DNS entries that tell other mail servers where to deliver email for a domain. When a domain uses Google Workspace, its MX records point to aspmx.l.google.com. When it uses Microsoft 365, they point to servers ending in protection.outlook.com. SPF records supplement this by listing which servers are authorized to send email on the domain's behalf, often including the provider's SPF include (e.g., _spf.google.com).

The Email Provider Filter checks both MX and SPF records because SPF can reveal the true provider even when a third-party filtering service (like Mimecast or Proofpoint) intercepts MX traffic. Learn more in our guide to MX record checking.

Legitimate Business Use Cases

• Sales and prospecting — knowing whether a prospect uses Google Workspace or Microsoft 365 helps tailor outreach and integrations.
• IT audits — verifying that domains across an organization point to the expected mail provider.
• Email migration planning — inventorying which providers are in use before a migration project.
• Security research — identifying provider distribution across a set of domains for infrastructure analysis.
• List cleaning — removing addresses with invalid domains or no MX records before a campaign.

Limitations and Accuracy Considerations

• The tool identifies the mail provider, not the individual email service (e.g., it detects Microsoft 365, not whether the tenant is on a specific plan).
• Domains using third-party filtering services (Mimecast, Proofpoint, Barracuda) may show the filter provider in MX records. The SPF check helps identify the underlying provider in many cases, but this is not always definitive.
• The tool does not verify whether a specific mailbox exists — it checks whether the domain can receive email and which provider handles it.
• DNS changes take time to propagate. Results reflect the current DNS state at the time of the check.
• The maximum batch size is 500 emails per request.