Data Points

📇 DNS Record

An individual DNS resource record (A, MX, TXT, NS, CNAME) exposing hosting and mail posture.

Network

Sources

0 no-auth

Disciplines

that use it

Mission domains

reach

Workbench

—

native tool

🔗 Analyst pivots

Search platform →OSINT pivot →Source catalog →

🔌 Sources that yield DNS Record (1)

Source	Category	Auth	Format
SecurityTrails Historical DNS & domain intel.	Domain	KEY	`json`	home↗ api↗

🧭 Disciplines

DOMINT (1) →

🎯 Mission Domains

Cyber Crime (1) →Malware (1) →

🔍 Lookup

📜 Playbook — DNS Record exploitation

Direction — frame the requirement for DNS Record: what decision does this support, by when?
Collection — pull the 1 mapped sources (0 free) and the native workbench; capture provenance and observe OPSEC.
Processing — normalize, de-duplicate and enrich the collected data.
Analysis — correlate against local holdings; apply ACH; assign confidence.
Dissemination — open a case, draft a report, share via STIX/MISP.
Feedback — set an alert rule / watchlist to monitor for change.

⚡ AI Skills & Automation

🤖 Copilot brief ⚡ AI Skills Resolve Enrich Auto-Collect Hunt Report Export

Automate unattended via the cron pipeline (collect → ingest → resolve → enrich → score → alert).

🗃 Data Management

+ Case + Campaign Watchlist Tag Save search Whitelist Export STIX/MISP Report

🧩 Advanced Capabilities

Link Analysis Pivot Explorer Timeline Threat Hunting Analytics Detection Rules Blockchain OSINT Pivot Passive DNS TAXII 2.1 MISP Feed Create Alert Rule NetFlow Coverage & Gaps

✨ Enrichment pathways

Enrichment Runner →Resolve locally →Enrichment → local →Integrations →

🎫 DNS Record

A DNS record is a typed entry in a zone (A, AAAA, MX, TXT, NS, CNAME, SOA, etc.) that maps a name to an address, service, or policy value. In investigations records expose infrastructure relationships, mail and hosting providers, SPF/DKIM/DMARC posture, and historical changes that reveal campaign pivots and misconfiguration.

Format: Zone entry: name TTL class type rdata. Type-specific rdata: A=IPv4, AAAA=IPv6, MX=priority+host, TXT=quoted string, NS/CNAME=FQDN, SOA=serial/refresh/retry/expire/minimum.

📡 How it is collected

Live DNS queries (dig/resolvers)
Passive DNS aggregation
Zone-transfer (AXFR) where allowed
Authoritative-server enumeration
Certificate and mail-header cross-reference
DNSSEC / DoH telemetry

📚 Enrichment & validation sources

SecurityTrails →dnsdumpster →VirusTotal →Google Public DNS (dns.google) →Cloudflare 1.1.1.1 DoH →MXToolbox →ViewDNS.info →dnsviz (DNSSEC) →

🔗 Pivot to

Domain Name →IP Address →Subdomain →mail server (MX) →name server (NS) →SPF/DKIM includes →CNAME target →

🧩 Analysis & hunting techniques

Record-type enumeration across a zone
Historical passive-DNS change diffing
SPF/DKIM/DMARC posture assessment
NS/MX provider fingerprinting
TXT-record verification-token pivoting
DNSSEC validation-chain analysis
Dangling-record / takeover detection
Fast-flux TTL anomaly detection

🔧 Tools

dig
dnsx
dnsrecon
dnsdumpster
MXToolbox
massdns
nslookup
dnsviz

⚡ Workbench actions

Query all record types
Diff against passive-DNS history
Assess SPF/DKIM/DMARC
Validate DNSSEC chain
Fingerprint NS/MX providers
Pivot TXT verification tokens
Detect dangling records
Flag low-TTL fast-flux

📊 Dashboard KPIs

Record count by typeTTL distribution / min TTLMail-auth posture score (SPF/DKIM/DMARC)DNSSEC-validated (yes/no)Changes since last snapshot

📂 Open

Data point profile →DNS audit →Passive DNS →Domain profile →Correlate →Link analysis →

Workstation · Copilot · AI Skills · Automation · Playbooks · Lookups · Docs · Reports

🤖 AI Copilot

Cron: 0 * * * * php /home/zaptf0zdggll/public_html/threats/cron.php

📜 Playbook

Open Response Playbook