Malte ZanderContents
DNS records show where a domain points and who runs it. The A record leads to the server and so to the host, the NS record to the DNS provider, the MX record reveals whether the domain can receive email, and TXT records often hold sender rules and verification codes that connect domains to each other. Look up every record type, save the result with a timestamp and repeat the lookup, because DNS changes quickly.
- The basic record types such as A, NS, MX, CNAME, SOA and TXT have been defined in the RFC 1035 standard since 1987 (RFC 1035).
- CAA records specify which certificate authorities may issue certificates for a domain (RFC 8659).
- SPF rules, which specify which servers may send email on behalf of a domain, are published in TXT records (RFC 7208).
- Since 28 January 2025, RDAP has been the authoritative source of registration data for generic domains. It complements the picture from DNS (ICANN).
Why do DNS records matter for investigations?
Because a fake site doesn't work without DNS. Every domain needs records that lead browsers and mail servers to the right servers. Those records are public, and they reveal a lot: where the site is hosted, who runs the DNS, whether the operator wants to send or receive email and sometimes which other domains belong to the same operator. Unlike the imprint on a fake, DNS records don't lie, because they have to work.
Which records matter, and what do they reveal?
| Record | What it defines | What it tells you |
|---|---|---|
| A and AAAA | The server's IPv4 and IPv6 address | Leads to the host or CDN |
| NS | The domain's name servers | Who runs the DNS: registrar, CDN or a separate provider |
| MX | The domain's mail servers | Whether the domain can receive email |
| TXT | Free text, such as sender rules and verification codes | Sending intentions, links to services and other domains |
| CNAME | An alias to another name | Often points to a platform, such as a site builder or shop service |
| CAA | Permitted certificate authorities | Rarely set on fakes, but a sign of care |
| SOA | Primary name server and zone data | Technical details of the DNS operator |
What do MX records reveal?
Whether the operator plans to use email. A lookalike domain with an MX record can receive replies to phishing emails, for example when victims answer a fake invoice. It can also be used for email fraud in which someone writes to customers or suppliers in your company's name. A domain without a website but with an MX record is therefore not a harmless find. Report it and, if needed, warn your customers and partners.
What do TXT records reveal?
Two things. First, they hold SPF rules, which specify which servers may send on behalf of the domain (RFC 7208). A carefully configured SPF rule on a fresh lookalike domain shows that someone wants to send emails that get through spam filters. Second, many services leave verification codes in TXT records, for example to verify ownership for analytics or mail services. If the same code appears on several domains, they probably belong to the same account and therefore to the same operator. More on such connections in Linking cases.
What do NS and CNAME records reveal?
Who is responsible. NS records show the DNS provider. If a CDN such as Cloudflare appears there, the domain runs through its services, and your report needs to go through the CDN. If the registrar appears, it can remove records itself. A CNAME to a platform reveals that the fake sits with that service, such as a shop builder. The platform is then your direct contact. How to find the host is shown in Hosting and IP lookups.
How do you look up DNS records?
With built-in tools or web tools. On the command line, dig or nslookup return each record type individually, and many DNS tools on the web show all records at once. Three rules make the results reliable:
Look up every type, not just A. The interesting clues are often in MX and TXT.
Check the exact subdomain from the phishing link. Subdomains can have their own records.
Save with a timestamp. Keep the full output with date, time and time zone. Operators change records often, and a later lookup will show a different picture.
How do you track DNS over time?
By looking up regularly and comparing the results. A changed IP address can mean a move to another host, for example after a takedown. A new MX record can announce the next stage of a campaign. Specialised services collect DNS answers over long periods and show a domain's history. For most cases, though, your own logged lookups at the key moments are enough: at the find, before every report and after the takedown.
How does AI Fraud Protect help?
AI Fraud Protect looks up the DNS records for every find, identifies the host, DNS provider and CDN and adds everything to the evidence package with a timestamp. Reports to the responsible parties are prepared, and a person reviews and sends every message. New finds are matched against earlier cases.
Start the free fraud scan for a short report within 48 hours, or request a demo to see detection, evidence and takedown in the app.
FAQ
Is a domain without an A record harmless?
Not necessarily. Without an A record there's no website, but an MX record can still enable email. And records can be added at any time. Keep watching such domains.
May I look up DNS records of other people's domains?
Yes. DNS is a public system, and lookups are its normal purpose.
Why do I see different records than a colleague?
Because of caching, geo-DNS or a change between the lookups. That's why you always record the time and place of the lookup.
Can a DNS provider switch off a fake site?
It can remove the records, and the site is then unreachable under that domain. That's a good lever when the registrar is slow.
Sources
RFC 1035: Domain Names, Implementation and Specification, November 1987
RFC 8659: DNS Certification Authority Authorization (CAA) Resource Record
ICANN: launching RDAP, sunsetting WHOIS, 27 January 2025