This mode presents DNS intelligence from an offensive-awareness perspective. It is designed for security professionals, researchers, and anyone who wants to understand how attackers evaluate targets. No additional scanning or probing is performed beyond what the standard analysis already does.
What You May Do
Analyze any domain — DNS records are public by design and every query is a standard lookup
Use findings to strengthen your own security posture or advise others
Learn how DNS infrastructure is evaluated from an adversarial perspective
Report vulnerabilities you discover in DNS Tool itself (Safe Harbor Policy)
What You May Not Do
Use intelligence gathered here to attack, disrupt, or exploit any system
Attempt denial-of-service, traffic flooding, or resource exhaustion
Conduct social engineering, phishing, or unauthorized red-team activity
Access, modify, or exfiltrate data beyond what is publicly observable via DNS
System Architecture
TLP:CLEAR
Classification: Public ReleaseFIRST TLP v2.026.35.35
This document is published under TLP:CLEAR per FIRST TLP v2.0. No restrictions on distribution. Proprietary methodology, internal scoring algorithms, and infrastructure details have been withheld.
Intelligence Pipeline
Domain intelligence flows through a multi-stage pipeline: collection from distributed sources, analysis against RFC standards, classification into actionable verdicts, and delivery as structured intelligence products.
Internal pipeline sequencing, enrichment stages, and classification algorithms withheld
Dual-Engine Confidence Framework
Two independent engines audit the quality of every analysis using ICD 203 confidence methodology — one measures correctness, the other measures currency. Together they provide a holistic confidence assessment at scientific parity.
ICAE
Intelligence Confidence Audit Engine
Measures analysis correctness
Deterministic test cases across 9 protocols
Five-tier maturity model
SHA-3-512 tamper-evident audit trail
Historical regression tracking
\(C_{\text{cal}} = w \cdot C_{\text{raw}} + (1-w) \cdot \frac{\alpha}{\alpha+\beta}\)
ICuAE
Intelligence Currency Audit Engine
Measures data timeliness
Five quality dimensions
Self-tuning advisory pipeline
Excellence benchmarks from industry leaders
Standards: ICD 203 · NIST SI-7 · ISO 25012
\(Z_t = \lambda X_t + (1-\lambda)Z_{t-1}\)
ICIE Output
Analysis results
ICAE Evaluation
Correctness audit
ICuAE Evaluation
Currency audit
Confidence Score
Holistic assessment
ICAE Reliability-Weighted Shrinkage Calibration
$$C_{\text{cal}} = w \cdot C_{\text{raw}} + (1-w) \cdot \frac{\alpha}{\alpha+\beta}$$
Test case inventories, scoring formulas, maturity thresholds, and tuning parameters withheld
Protocol Coverage
Nine RFC-defined security protocols analyzed from multiple intelligence sources with multi-resolver consensus. All analysis uses open-standard protocols and publicly available DNS records.
SPF
RFC 7208
DKIM
RFC 6376
DMARC
RFC 7489
DANE/TLSA
RFC 6698
DNSSEC
RFC 4033–4035
BIMI
BIMI Working Group
MTA-STS
RFC 8461
TLS-RPT
RFC 8460
CAA
RFC 8659
Open-Core Architecture
Dual-repository structure separates the open-core application framework from proprietary intelligence modules. Build-tag isolation enforces clean boundary contracts verified by automated integrity tests.
Public — Open-Core (BUSL-1.1)
Application framework
HTML templates & static assets
Boundary integrity test suite
Build & deployment scripts
OSS stub contracts
BUSL-1.1 License
Private — Proprietary
Intelligence modules
Provider databases
Classification methodology
Detection algorithms
Commercial roadmap
BUSL-1.1 License
Build-Tag Isolation Boundary
Repository names, build-tag identifiers, sync mechanisms, and module interfaces withheld
Intelligence Products
Five distinct intelligence products serve different audiences and operational contexts — from board-ready executive briefs to adversarial-lens reconnaissance reports.
Engineer's Report
Technical · RFC-cited Full protocol analysis
Executive's Brief
Board-ready TLP-classified
Recon Report
Adversarial lens Red-team perspective
Domain Dossier
Aggregated intelligence view
Domain Comparison
Side-by-side posture analysis
Drift Engine & Notification Pipeline
Continuous posture monitoring detects DNS configuration changes between analyses. When drift is detected, the notification pipeline routes alerts to the right people through the right channels.
Domain Scan
ICIE analysis
Posture Hash
SHA-256 canonical
Posture Diff
Field-by-field comparison
Severity Engine
danger · warning success · info
Drift Event
PostgreSQL record
Watchlist Lookup
domain_watchlist
Queue Notifications
Per-endpoint routing
Delivery Loop
30s poll · 50/batch SSRF-protected
Discord
Webhook embed
Internal detection thresholds and flickering domain analysis methodology withheld.
GitHub Issues Triage
Three-tier issue routing with automated validation. Research-critical issues require RFC-backed evidence. Security reports are auto-redirected to private channels. All issues follow a label-based state machine.
Canonical architecture diagrams rendered from version-controlled Mermaid source files. These are the engineering source of truth — diffable, auditable, and tied to releases.
_csrf — Prevents cross-site request forgery. Required for form submissions. Security-only.
_dns_session — Only exists if you choose to sign in. No account required to use DNS Tool.
We log your IP address for two reasons: rate limiting (so nobody abuses the service) and security (identifying malicious actors and complying with legal obligations). We check source geography for analysis accuracy — DNS responses vary by region, and knowing which resolver answered from where makes the science better.
No tracking cookies. No analytics cookies. No ad networks. No data brokers. Our code is open-core — the application framework is publicly available under BUSL-1.1 with timed Apache-2.0 conversion. Verify it yourself.
If you create an account and want out, account deletion removes your login and scan history. Public domain analyses remain available because they contain only public DNS records, already hashed. Full details: Privacy Pledge.
