DNS Lookup With Mail Posture Scored and Sourced
Most DNS lookup tools print the record set and stop. Osintpro reads the same records and tells you what they mean: whether the domain can be spoofed, who runs its mail, who can issue certificates for it and who controls the zone.
Every answer carries the endpoint it came from and a UTC retrieval time, because DNS answers change and an undated one proves nothing.
- Passive collection only.
- Public sources.
- Findings carry their record.
- Domains only, never a person.
Run the lookup on a domain you are authorized to assess.
The sweep queries a public resolver over DNS-over-HTTPS. It is a read against public infrastructure, not traffic to the target. Leave every module on for the full picture or narrow it to DNS and mail posture.
-
It runs in your browser. Queries go to public DNS and RDAP endpoints, not through us.
-
Nothing reaches the subject. The domain you enter is never contacted, probed or scanned.
-
A domain, never a person. There is no input on this panel that accepts an individual.
-
Findings carry their evidence. Raw record, source endpoint and the UTC moment of retrieval.
Domain footprint sweep
passive collection only
Every finding will carry four things
- 1 Severity. What the record means for the decision in front of you.
- 2 The raw record. Exactly as the source returned it, unedited.
- 3 The source endpoint. The request that produced it, so it can be re-run.
- 4 The UTC retrieval time. Records change. Without this it is an assertion.
Reads dns.google and rdap.org from your browser. Nothing is sent to the domain you enter.
Tick the authorization box, then run the sweep. Enter the domain you are authorized to assess, then run the sweep. Run the sweep. The report lands here.
[]
Scope:
Analyst summary
The record types that carry investigative signal.
A DNS zone is a public description of how an organization is put together. These are the record types that answer a question worth writing down.
A / AAAA
- What it holds
- IPv4 and IPv6 addresses for a hostname
- What an analyst reads from it
- Where the front door is, whether a proxy or CDN sits in front, and whether there is any redundancy at the apex at all.
MX
- What it holds
- Mail exchangers, with priorities
- What an analyst reads from it
- Which vendor sees this organization's mail. It is the surface a phishing campaign will imitate and a vendor concentration fact in its own right.
TXT (SPF)
- What it holds
- Which hosts may send mail as this domain
- What an analyst reads from it
- Whether the domain can be spoofed. The closing mechanism is the whole finding: -all is enforcing, ~all is advisory, no record at all means anyone may send as you.
TXT at _dmarc
- What it holds
- What receivers should do when SPF or DKIM fails
- What an analyst reads from it
- p=none means the policy is monitoring only and the controls are published but not enforced. p=reject is the enforcing setting.
NS
- What it holds
- The delegated nameservers
- What an analyst reads from it
- The vendor that can rewrite every record on the domain. Two independent providers is a resilience choice; one is a single point of control.
CAA
- What it holds
- Which certificate authorities may issue for the name
- What an analyst reads from it
- Without a CAA record, any publicly trusted CA in the world may issue a certificate for the domain. With one, the set is closed.
PTR (reverse)
- What it holds
- The name the address block owner set for an IP
- What an analyst reads from it
- Attributes the hosting network rather than the domain owner, which is exactly why it is useful for infrastructure mapping.
TXT (verification)
- What it holds
- SaaS domain-verification strings
- What an analyst reads from it
- Read as a set, the TXT records are a public inventory of the vendors an organization has connected to its domain.
How mail posture is scored, in full.
Nothing here is a proprietary score. It is a published standard read literally, which is why the reasoning can be printed next to the finding.
-
Step 1
SPF, from the TXT record at the apex
The record lists the hosts allowed to send mail as the domain and closes with an all mechanism. -all is a hard fail and scores as a pass. ~all is a soft fail: receivers are told to accept unauthorised mail and merely mark it, which is a medium finding. +all authorizes the entire internet and is a high finding. No SPF record at all is also high.
-
Step 2
DMARC, from the TXT record at _dmarc
DMARC tells a receiver what to do when SPF and DKIM fail, and where to send reports. p=reject is enforcing and scores as a pass. p=quarantine is partial. p=none means monitoring only, which is the most common gap we see and is scored high because the controls exist but do nothing.
-
Step 3
Mail provider, from the MX hostnames
The exchangers name the vendor. Google Workspace, Microsoft 365, Proofpoint, Mimecast and the rest have distinctive hostnames. This is informational rather than a defect, but it is the fact a phishing simulation or a vendor concentration review needs.
-
Step 4
Certificate authorization, from CAA
A CAA record restricts which authorities may issue for the name. Its absence is a medium finding because it leaves the issuance surface fully open, and it is a one-line fix.
-
Step 5
Zone control, from NS
The nameserver set names whoever can change everything else, including MX. On your own estate this is an access-review item. On a target it tells you where the leverage is.
This is a passive read, and that is the point.
A DNS lookup asks a public resolver a question. It does not send a packet to the target, it does not attempt a connection to their services, it does not authenticate and it does not appear in their logs as an approach. That is what makes it usable on a vendor you have no authorization to test, or on an acquisition target that does not yet know you exist.
It is also why the whole product sits on this side of the line. Osintpro reads public records and stops there. If a finding would require touching the target, it does not appear, and the report says which modules ran rather than implying coverage it did not have. The full boundary is set out on the security page.
The other half of the same discipline is scope. Before the sweep runs you state the purpose and confirm your authorization, and that declaration is stamped on the report. A DNS record is public either way; what makes the work defensible is that the reason for collecting it was written down before it was collected, not after.
Questions people ask about DNS lookups.
Query a public resolver for the record types you care about: A and AAAA for hosts, MX for mail routing, NS for delegation, and TXT for SPF and DMARC policy. The command line answers one record at a time. What matters for an assessment is collecting the whole set together, because the posture only reads correctly as a set.
SPF lives in a TXT record on the domain itself, starting v=spf1. DMARC lives in a TXT record at _dmarc followed by the domain, starting v=DMARC1. Read the policy tag: p=reject enforces, p=quarantine partly enforces, and p=none publishes a policy that blocks nothing at all.
It means the domain publishes a DMARC record but instructs receivers to take no action on messages that fail authentication. It is a legitimate monitoring stage on the way to enforcement, and it is also where a large share of domains stop permanently. For a counterparty assessment, p=none is a finding, not a pass.
Yes. DNS is a public directory by design and answering queries is what it exists to do. Reading a third party's published records is not access to their systems, requires no permission, and leaves nothing in their logs. That is what separates a records lookup from a scan, which does need written authorization.
You query the record set for each domain programmatically and normalize the answers so they can be compared. The value is rarely in one domain. It is in running the same record set across a vendor list or a domain portfolio and seeing which ones have no DMARC policy, no MX, or delegation somewhere nobody expected.
A lookup asks resolvers for records the domain owner published. A scan probes infrastructure to discover what is there, which contacts systems you may not be authorized to touch. Lookups are passive and safe to run on any subject. Scans belong inside an engagement with authorization in writing.
More OSINT tools and lookups
New to the category? Start with open source intelligence, then see how a scoped case runs or read the analyst notes on the blog.
Run one scoped sweep and see what a sourced finding looks like.
The demo is free, it takes a domain and never a person, and it produces the same evidence chain the paid report does.
- Passive collection only, from public sources.
- A domain, never a person. There is no input for one.
- Your case data stays yours. No card required.