Domain Intelligence
Query DNS records including A, AAAA, MX, TXT, NS, CNAME, and SOA records for any domain.
A DNS lookup queries the Domain Name System to resolve a domain name into its associated IP addresses and other records. DNS translates human-readable domain names like example.com into machine-readable IP addresses like 93.184.216.34, and also stores MX records (mail servers), TXT records (SPF, DKIM, verification strings), NS records (authoritative name servers), CNAME records (aliases), and SOA records (zone authority). This tool queries these record types to give you a complete picture of a domain's DNS configuration.
For security professionals, DNS is one of the first areas to investigate during reconnaissance, incident response, and threat analysis. DNS records reveal where a domain points, which servers handle its email, who its authoritative name servers are, and whether DNSSEC is enabled. Changes in DNS records can indicate domain hijacking, phishing infrastructure setup, or misconfiguration that exposes services unintentionally.
Understanding DNS is fundamental to network security. Every web request, email delivery, and API call depends on DNS resolution. A compromised DNS configuration can redirect traffic, intercept email, and enable man-in-the-middle attacks. Regular DNS monitoring and analysis are essential security practices.
A and AAAA records map a domain to IPv4 and IPv6 addresses respectively. These are the most fundamental DNS records, determining where web traffic is directed. If an attacker compromises DNS and changes the A record, all traffic to the domain goes to the attacker's server. Monitoring A and AAAA record changes is a basic security practice.
MX records identify the mail servers responsible for receiving email for a domain. They include a priority value that determines the order of server preference. Misconfigured MX records can cause email delivery failures or allow email interception. MX records also reveal which email provider a domain uses (Google, Microsoft, ProtonMail), which is useful intelligence.
TXT records store text information associated with a domain, most commonly SPF (Sender Policy Framework), DKIM (DomainKeys Identified Mail), and DMARC policies that protect against email spoofing. They are also used for domain verification by third-party services. Examining TXT records reveals a domain's email security posture and which services have been authorized to act on its behalf.
DNS spoofing and cache poisoning are attacks that inject false DNS records into resolver caches, redirecting traffic to malicious servers. DNSSEC (DNS Security Extensions) prevents these attacks by cryptographically signing DNS records, allowing resolvers to verify that responses have not been tampered with. This tool can show whether a domain supports DNSSEC through its SOA and DNSKEY records.
DNS-based data exfiltration and command-and-control (C2) use DNS queries and responses to smuggle data past network defenses. Attackers encode data in subdomain queries or use DNS tunneling tools to establish covert channels. Monitoring unusual DNS query patterns—high query volumes to single domains, queries with high-entropy subdomains, or queries to uncommon record types—is an important detection technique.
For incident response, DNS records are often the most reliable source of infrastructure intelligence. While web content can be changed instantly, DNS records have TTL (time-to-live) values and are often cached, making them easier to track over time. Historical DNS data reveals infrastructure patterns that help map threat actor infrastructure.