DNS & Domain Lookup
Query global DNS records (A, MX, TXT) to securely investigate suspicious domains and trace the true origin of phishing links.
DNS Lookup
Query global Domain Name System records directly from your browser.
How OSINT Uses DNS
OSINT (Open Source Intelligence) involves collecting publicly available data to assist in cybersecurity investigations. One of the very first steps in investigating a suspicious email or a phishing link is analyzing the domain's DNS records.
Key Records to Look For:
- A Records (IPv4): This tells you the physical IP address of the server hosting the website. You can cross-reference this IP to see if it is hosted in a country known for cybercrime, or if it sits behind a protective proxy like Cloudflare.
- MX Records (Mail Exchange): If you receive a scam email, looking up the MX record of the sender's domain will tell you which company is actually hosting their email (e.g., Google, Microsoft, or a sketchy offshore provider).
- TXT Records: These are text records often used to verify domain ownership. Cybersecurity analysts look at SPF, DKIM, and DMARC text records to determine if a domain is properly configured to prevent email spoofing. Scammer domains usually have missing or misconfigured TXT records.
Note: This tool uses Google's public DNS-over-HTTPS (DoH) API to securely fetch records without exposing your local network resolver.