DNSai for OSINT
Public DNS is one of the few places an organisation has to publish accurate information about its own infrastructure. This short overview covers what you can read from it — and how much of an OSINT picture assembles itself before you have touched anything intrusive.
What you'll take away
- Everything shown comes from records the target publishes publicly.
- MX records identify the email provider and any security gateway in front of it.
- The DMARC policy reveals how seriously a domain treats spoofing.
- TXT records expose which SaaS platforms a company has verified ownership with.
- The result is an infrastructure profile built entirely from passive sources.
What public DNS gives away
DNS has to be public to work. Every organisation that sends mail, hosts a website or verifies a SaaS tenancy publishes records that describe its stack, and those records are readable by anyone without authentication, without touching the target's systems, and without leaving anything unusual in a log.
MX records name the mail provider. SPF includes enumerate the third parties permitted to send on the domain's behalf, which is effectively a list of the marketing, ticketing and billing platforms in use. TXT verification tokens name still more. None of that requires a single intrusive request.
Reading the mail stack
For OSINT work the email configuration is usually the richest seam. It tells you who runs the mail, whether a secure email gateway sits in front of it, which vendors can send as the domain, and — from the DMARC policy — whether the organisation has done the work to stop others impersonating it.
A domain at p=reject with a tight SPF record belongs to a team that has been through this exercise. A domain with no DMARC record at all is a different kind of finding.
Passive by construction
Because every input is a public DNS record, this approach stays firmly on the passive side of reconnaissance. That matters for engagements with scope constraints, for competitive research, and for due diligence where you are assessing an organisation you have no relationship with yet.
Questions
- Is any of this intrusive?
- No. Everything covered in the video is read from public DNS records that the target publishes for the internet to resolve.
- Can I check a company without signing in?
- Yes — the lookup tools on the site run without an account.
Try what's in the video
More DNSai videos
← Back to the Media CenterAll videos, guides and brand resources