dig gmail.com returns this:
;; ANSWER SECTION: gmail.com. 3600 IN MX 40 alt4.gmail-smtp-in.l.google.com. gmail.com. 3600 IN MX 30 alt3.gmail-smtp-in.l.google.com. gmail.com. 3600 IN MX 20 alt2.gmail-smtp-in.l.google.com. gmail.com. 3600 IN MX 5 gmail-smtp-in.l.google.com. gmail.com. 3600 IN MX 10 alt1.gmail-smtp-in.l.google.com.
How about the smtp.gmail.com, why isn’t it included? Is there a way to find it through some utility? Or is it what can found in the documentation of gmail only?
The same question goes for other email services out there.
My initial goal is find all smtp servers of an email provider.
How about the smtp.gmail.com, why isn’t it included?
smtp.gmail.com doesn’t receive email for the gmail.com domain. You asked for the MX record for gmail.com. The answer you got was exactly that. The MX record designates which host(s) receives email for a given domain. The MX record tells you nothing about client submission SMTP servers, etc. A host named
smtp.example.com need not be the host that receives email for said domain. A host that receives email for a domain could literally be named anything.
If you want to know what host(s) receives email for a given domain then perform an MX record lookup just as you did. If you want to know what host a client of a specific email provider should use to send email, consult the email hoster’s documentation.