DNS analysis

When it applies

Early recon and anytime you want surface/intel from DNS: subdomains, mail/infra hints, cloud providers, dangling records (takeover leads), and origin IPs hiding behind a CDN.

Why it works

DNS is a public map of an org's infrastructure. Records leak providers (CNAME → SaaS), mail and SPF/DMARC hosts, and misconfigurations (open zone transfer dumps everything; NSEC lets you walk a DNSSEC zone). Stale records point at deprovisioned services (→ takeover).