Overview
DNS records are a core domain-intelligence source, revealing an organization's infrastructure and subdomains. This lesson covers DNS in OSINT.
Learning objectives
- Explain what DNS reveals in OSINT.
- Identify useful record types.
- Connect DNS intelligence to infrastructure mapping.
Core concept
DNS (from the networking and passive-recon lessons) maps names to addresses and other data, and querying an organization's public DNS reveals substantial intelligence: A/AAAA records (subdomains and where they point — hosting), MX (mail infrastructure), NS (name servers), TXT (services/policies in use), and CNAME (aliases to related services). Analyzing these builds a picture of the organization's infrastructure and subdomains — a core, largely-passive domain-intelligence activity using the public DNS system.
How it works
The practitioner queries the organization's public DNS for its domains, gathering the records: A/AAAA (revealing subdomains and their hosting IPs), MX (mail providers), NS (name servers/DNS provider), TXT (which may indicate services), and CNAMEs (related services). Subdomain discovery via DNS is especially valuable for mapping the footprint. Analyzing these records reveals the organization's hosting, mail, and name-server infrastructure and its subdomain landscape. This is public data gathered passively (ordinary DNS resolution), and findings are verified and treated per source quality (DNS data can be current or stale). It combines with WHOIS, certificate data, and historical clues for a full domain picture.
Practical example
Querying an organization's public DNS, the practitioner finds A records revealing several subdomains and their hosting IPs, MX records showing the mail provider, NS records indicating the DNS provider, and TXT records hinting at services in use. Analyzing these builds a clear picture of the organization's infrastructure and subdomain footprint. All from public DNS, gathered passively. This infrastructure map informs, for example, a security assessment of the organization's public presence — with findings verified.
Cybersecurity relevance
DNS is a core, largely-passive domain-intelligence source revealing an organization's infrastructure and subdomains — valuable for security assessment (attack surface, subdomain footprint), threat intelligence, and due diligence, connecting to the networking DNS and ethical-hacking passive-recon lessons. It uses public DNS data. For defenders, it highlights what DNS publicly reveals (and the value of managing subdomain sprawl and revealing records). Analysis is verified and treated per source quality (DNS changes). DNS intelligence combines with WHOIS, certificates, and historical data to build the full domain picture — a central OSINT technique for mapping public technical presence.
Common mistakes
- Overlooking DNS records (esp. subdomains) in domain intelligence.
- Treating DNS data as static rather than verifying currency.
- Forgetting to combine DNS with WHOIS/certificates/historical data for a full picture.
Key takeaways
- DNS records (A/AAAA, MX, NS, TXT, CNAME) publicly reveal an organization's hosting, mail, name-server infrastructure, and subdomains.
- DNS-based subdomain discovery is especially valuable for footprint mapping; analysis is passive (public DNS) and verified.
- A core domain-intelligence source (connecting to networking/passive-recon lessons) that combines with WHOIS, certificates, and historical data for the full picture; it highlights footprint exposure for defenders.
Check your understanding
- What infrastructure information can DNS records reveal about an organization?
- Why is DNS-based subdomain discovery particularly valuable in domain intelligence?