What DNS Records Mean and Why Attackers Use Them

Every time you type a domain name into your browser, a DNS lookup happens in the background. Your device asks a resolver: what IP address belongs to this name? The resolver asks a chain of servers and returns an answer within milliseconds. You never see it.

What most people do not realize is that DNS records are completely public. Anyone can query them. Attackers use this fact to map out a target's infrastructure before they do anything else.

The Records You Should Know

A record: Maps a hostname to an IPv4 address. example.com A 93.184.216.34 means that domain lives at that IP. Attackers use A records to find which hosting provider a company uses, whether they have a CDN in front of their servers, and what their actual origin IP is.

AAAA record: The same as A but for IPv6 addresses. Increasingly relevant as IPv6 adoption grows.

MX record: Points to the mail servers that handle incoming email for a domain. If you want to send someone at example.com an email, your mail server looks up the MX records to find where to deliver it. Attackers use MX records to identify which email provider a company uses and to understand their anti-spam infrastructure.

TXT record: A free-form text field. Companies use it for three major things: SPF (listing which servers are allowed to send email on their behalf), DKIM (publishing the public key used to verify signed emails), and domain ownership verification (Google, Microsoft, and others ask you to add a TXT record to prove you own the domain). TXT records can reveal a lot about what services a company uses.

CNAME record: An alias. www.example.com CNAME example.com means the www subdomain points to the root domain. Companies use CNAMEs to point subdomains at third-party services. Attackers look for CNAMEs pointing at services the company no longer uses. These are called dangling DNS records, and they can be taken over.

NS record: Identifies the authoritative name servers for the domain. If these are compromised, an attacker can redirect any record under the domain anywhere they want. NS records are high-value targets.

SOA record: Contains administrative information about the zone: the primary name server, the email of the administrator, and timing values for how often secondary servers should refresh. Occasionally leaks internal information.

What Attackers Do With This

A competent attacker starts any engagement by running a DNS lookup on the target domain. From the results they can learn:

What cloud provider hosts the main site (useful for targeting cloud-specific vulnerabilities)
What email provider handles mail (useful for understanding phishing defenses)
What third-party services are connected to the domain via CNAME
Whether any subdomains point at abandoned services that can be taken over
Whether SPF is configured correctly, which tells them whether spoofing the domain might work

All of this information is freely available. There is no firewall protecting DNS records.

The Subdomain Enumeration Problem

Beyond the records you explicitly create, attackers try to discover subdomains you may have forgotten about. Tools like crt.sh search certificate transparency logs, which list every subdomain that has ever had an SSL certificate issued. A development server you stood up two years ago and stopped using still has a DNS record. If it is reachable and unpatched, it is a target.

What You Should Do

Audit your DNS records periodically. Remove any CNAME records pointing at services you no longer use. Make sure your SPF record is tight: use -all at the end rather than ~all to reject rather than soft-fail unauthorized senders. Add a DMARC record if you have not already.

The DNS Lookup tool on this site lets you query any domain's records instantly. The Subdomain Finder tool uses certificate transparency logs to show you subdomains that exist, including ones you might have forgotten about.

DNS reconnaissance takes an attacker about five minutes. Your audit should take about thirty. Do the thirty minutes first.