MyRecon OSINTDNS Records Explained: A, MX, TXT, NS and More
DNS is the internet's address book. When you look up a domain's DNS records, you are reading the instructions that tell the world where its website lives, where its email goes, and which services it trusts.
What DNS does
Computers route traffic using IP addresses, but people use names. The Domain Name System (DNS) bridges the two: it translates a human-friendly name like example.com into the addresses and settings that machines need. A domain's DNS records are published by its authoritative nameservers, and anyone can query them — which makes DNS a rich, entirely public source of information about how a domain is set up.
The record types worth knowing
A and AAAA — where the website lives
An A record maps a name to an IPv4 address; an AAAA record does the same for IPv6. These tell you the server the domain points to. From there you can look up the IP's geolocation and hosting provider to learn where the site is actually served from.
MX — where the email goes
MX (Mail Exchanger) records specify the mail servers that handle email for the domain. They are a giveaway of which email provider a company uses — MX records pointing to Google or Microsoft's mail infrastructure tell you the organisation runs on Google Workspace or Microsoft 365, for example. If a domain has no MX records, it usually cannot receive email at all.
NS — who is in charge of the domain's DNS
NS (Nameserver) records list the authoritative servers for the domain. They reveal the DNS provider (such as Cloudflare, AWS Route 53, or the registrar's own service) and are a useful fingerprint of a domain's infrastructure.
TXT — verification and email security
TXT records hold free-form text, and they are where a lot of the interesting detail hides. They commonly include:
- SPF (starting with v=spf1) — lists which servers are allowed to send mail for the domain.
- DKIM and DMARC policies that protect against email spoofing.
- Verification strings from services the domain has connected — Google, Microsoft, Atlassian, Facebook, and many others each drop a verification token here, which quietly reveals which third-party tools the organisation uses.
CNAME, SOA and CAA
A CNAME is an alias that points one name at another. The SOA (Start of Authority) record holds administrative metadata about the zone, including refresh timers. A CAA record specifies which certificate authorities are allowed to issue TLS certificates for the domain — a small but meaningful security control.
DNS-over-HTTPS: accurate and private lookups
Traditional DNS queries travel in plain text and can be intercepted or tampered with along the way. DNS-over-HTTPS (DoH) sends the query inside an encrypted HTTPS connection to a trusted resolver, which improves both privacy and integrity. MyRecon's DNS tool resolves records over DoH, so the answers you see are consistent and not quietly rewritten by an intermediate network.
Reading the whole picture. On its own, one record is a fact. Together, a domain's records tell a story: where it is hosted, who provides its email, and which services it trusts. Pair them with the registration record for a complete view.
What an investigator learns from DNS
DNS answers practical questions quickly. Is this domain configured to send email, or is it parked? Which cloud does it run on? Has the owner set up anti-spoofing protection? Which SaaS tools has the company connected? None of this requires special access — it is all published for the internet to use, which is exactly what makes it such a dependable OSINT source.