DNS Record Explainer

The Domain Name System maps human names to the data that makes the internet work — addresses, mail routes, service locations, and text policies. Reading a zone's records tells you a great deal about an organization's infrastructure and its email-security posture. Paste records in common formats (zone-file lines or simple "TYPE value" pairs) and this tool identifies each type, explains its purpose, and flags what matters for security.

The records you'll meet. A/AAAA map a name to an IPv4/IPv6 address. CNAME aliases one name to another. MX lists mail servers. NS delegates the zone to authoritative name servers. TXT holds free-form text that in practice carries the email-authentication trio — SPF (v=spf1…), DKIM public keys, and DMARC policy (v=DMARC1…) — plus domain-verification tokens. CAA restricts which certificate authorities may issue for the domain. SOA carries zone administration metadata.

Security relevance. The tool highlights the high-value checks. An SPF record ending in ~all (softfail) or +all (pass anything) barely constrains spoofing; -all (hardfail) is the strong form. A DMARC policy of p=none only monitors, whereas p=reject actually stops spoofed mail. A missing CAA record lets any CA issue certificates for you. And a CNAME or A record pointing at a decommissioned cloud resource is the setup for a subdomain takeover — an attacker re-registers the abandoned target and serves content from your name.

How you'll use it. During recon, dump a target's records and let the explainer surface weak email policies and dangling aliases. During your own audits, use it as a checklist: is SPF hardfail, is DMARC enforcing, is CAA present, are there orphaned subdomains? A practical gotcha the tool helps with is the SPF ten-lookup limit: SPF records that chain too many include: mechanisms exceed the DNS-lookup budget and fail open, so a record that looks strict can silently stop authenticating — worth checking whenever a domain uses several third-party senders.

Defensive angle. Publish SPF (-all), DKIM, and an enforcing DMARC policy to stop domain spoofing; add CAA to constrain certificate issuance; and inventory every subdomain so none points at infrastructure you no longer control. When a suspicious message does arrive, the email header analyzer shows whether these policies actually held for that message by reading its authentication results and hop path. DNS is public by design — assume attackers read it too.