Who added MX record which was irrelevant

2 days ago our mailing system was stopped sending mails, when I asked our hosting, they said , there is something wrong in MX records. When I checked it , I saw one MX record line which is irrelevant!. I never added extra record, how colud this happened?
when I deleted the record , mailing systems turns to normal …
could you explain why it might happen ?
extra MX line was : mail. nickstel. com

my domain : bandococukevi

thank you

The audit log should tell you who added that.

Apart from some possible unauthorised account access (change password) you do have an actual security issue, however, as your server does not have a valid certificate and you have an insecure encryption mode on Cloudflare.

In short, your site is currently not secure. That may have even exposed your password and allowed a third party to access your Cloudflare account.

Make sure to fix the server certificate.


Where are you seeing this?

I only see mx-in02.natrohost.com and mx-in02b.natrohost.com


I deleted it in order to maket he mailing system Works properly

Pls see below the pic before I deleted

Yes, that is clear and why I mentioned the audit log. Did you check that?

But if you have an insecure account and website (which leaks your passwords), you should fix that first.

You need to fix your server certificate and the encryption mode.

1 Like

I’d recommend to perform exactly these steps in this order

  1. Pause Cloudflare - Pause Cloudflare · Cloudflare Fundamentals docs
  2. Set the encryption mode to Full Strict
  3. Contact your host to have the certificate fixed
  4. Verify if the site loads fine on HTTPS, if it doesn’t contact your host again
  5. Unpause Cloudflare once it loads fine on HTTPS
  6. Go through the audit log to determine who set that up
  7. Change your password and rotate all access tokens
  8. Drop any granted access to other user accounts on Cloudflare

In exactly that order

1 Like

Thank you for the detailed info J

I’ll do the steps and learn more about Cloudflare J

All the best


This topic was automatically closed 3 days after the last reply. New replies are no longer allowed.