Intelligence Sources
Every data source, methodology, and limitation — fully transparent.
Built on a native Go DNS engine with Unix-heritage verification tools and public protocols. Every conclusion can be independently verified.
Our Principles
Every analysis step maps to a standard command you can run yourself.
When a source is unavailable or rate-limited, we say so — never fabricating results.
Multiple independent methods reach the same conclusion. No single point of failure.
Grounded in decades of Unix tradition and open standards. No proprietary magic.
DNS Resolution & Record Queries
The foundation of every analysis. Five independent resolvers queried in parallel via native DNS over UDP/TCP with majority-agreement consensus. The dig commands shown are the equivalent terminal commands for manual verification.
Multi-Resolver DNS Consensus
Primary FreeAll DNS record queries (A, AAAA, MX, NS, TXT, CNAME, DNSKEY, DS, TLSA, CAA, HTTPS, SVCB, CDS, CDNSKEY, SMIMEA, OPENPGPKEY). Five resolvers queried in parallel with majority-agreement consensus to detect censorship, poisoning, or propagation delays.
dig @1.1.1.1 +short A example.com
Cloudflare DNS (1.1.1.1)
Resolver FreePrimary consensus resolver. Privacy-focused, DNSSEC-validating resolver operated by Cloudflare.
dig @1.1.1.1 +short A example.com
Google Public DNS (8.8.8.8)
Resolver FreePrimary consensus resolver. Globally distributed, DNSSEC-validating resolver operated by Google.
dig @8.8.8.8 +short A example.com
Quad9 (9.9.9.9)
Resolver FreeConsensus resolver with threat-intelligence filtering. Swiss-based nonprofit, DNSSEC-validating.
dig @9.9.9.9 +short A example.com
OpenDNS / Cisco Umbrella (208.67.222.222)
Resolver FreeConsensus resolver. Enterprise-grade resolver operated by Cisco.
dig @208.67.222.222 +short A example.com
DNS4EU (86.54.11.100)
Resolver FreeEU-sovereign consensus resolver. Operated by a European Commission-funded consortium across 10 EU member states. Unfiltered variant, DNSSEC-validating, GDPR-compliant. Infrastructure exclusively within EU borders.
dig @86.54.11.100 +short A example.com
Authoritative NS Direct Query
Primary FreeDirect queries to the domain's own authoritative nameservers for DKIM selector probing, delegation checks, and DNSSEC chain validation. Bypasses resolver caching for ground-truth data.
dig @ns1.example.com +short A example.com
Infrastructure Intelligence
Hosting, CDN, and network attribution through standard DNS protocols and community services.
Reverse DNS (PTR Records)
Primary FreeIdentifies hosting providers by resolving IP addresses back to hostnames. A PTR record for a CloudFront IP returns server-xxx.cloudfront.net, directly revealing the hosting provider without any third-party API.
dig +short -x 13.248.169.35
Team Cymru IP-to-ASN Mapping
Community FreeMaps IP addresses to their owning Autonomous System Number (ASN) and organization. Identifies whether an IP belongs to AWS (AS16509), Cloudflare (AS13335), Google (AS15169), etc. Used for CDN/edge detection and infrastructure attribution.
dig +short TXT 35.169.248.13.origin.asn.cymru.com
SMTP Transport Probing
Primary FreeLive STARTTLS verification of mail servers. Tests TLS version support, cipher suites, certificate validity, and DANE/TLSA matching. Falls back to DNS-inferred analysis when direct connection is unavailable.
openssl s_client -starttls smtp -connect mx.example.com:25
Threat Intelligence
Phishing and threat detection powered by community-maintained open data.
OpenPhish Community Feed
Community FreeCommunity-maintained phishing URL feed used by the Email Header Analyzer to cross-reference URLs found in email bodies and headers against confirmed phishing campaigns. Cached locally with a 12-hour TTL.
curl -s https://openphish.com/feed.txt | head -20
Historical & Discovery
DNS change timelines and subdomain discovery from certificate transparency logs.
Certificate Transparency (crt.sh)
Public Log FreeDiscovers subdomains by searching Certificate Transparency logs for all SSL/TLS certificates ever issued for a domain. Reveals infrastructure that may not be publicly linked.
curl -s 'https://crt.sh/?q=%.example.com&output=json' | jq '.[].name_value'
Registry & Reference
Domain registration data and RFC standards metadata.
IANA RDAP
Registry FreeRegistration Data Access Protocol — the modern successor to WHOIS. Retrieves domain registrar, registration dates, status codes, and nameserver delegation from the authoritative registry.
curl -s 'https://rdap.verisign.com/com/v1/domain/example.com' | jq '.entities[0].vcardArray'
IETF Datatracker
Reference FreeFetches RFC metadata (titles, status, obsoleted-by) for all cited RFCs. Ensures RFC references in remediation guidance are current and accurate.
curl -s 'https://datatracker.ietf.org/doc/api/rfc/?format=json&rfc=7489' | jq '.objects[0].title'
ip-api.com
Supplemental FreeVisitor IP geolocation only (your location flag in the footer). Not used for any analysis data. Degrades gracefully on failure.
Standards & Classification Colors
Every color used for security classification in DNS Tool reports traces to a published standard. Where formal specifications exist, we cite the exact hex values. Where colors are industry convention rather than specification, we note the distinction.
Traffic Light Protocol (TLP) v2.0
Standard Formally SpecifiedInformation sharing classification used on all DNS Tool reports. Colors are formally specified by FIRST with exact hex values. Default classification: TLP:AMBER.
#FF2B2B
#FFC000
#FFC000
#33A532
#FFFFFF
CVSS v3.1 Severity Scale
Convention Industry StandardScore ranges formally specified by FIRST CVSS v3.1. Colors are not part of the CVSS specification — they are de facto industry convention derived from the NIST NVD implementation. Used for posture scoring and risk-level badges.
#cc0000
#df3d03
#f9a009
#ffcb0d
#53aa33
The Intelligence Engine
Analysis Engine — Decision-Ready Intelligence
DNS Tool’s core engine is built in Go using the miekg/dns v2 library — constructing raw DNS packets in memory and sending them directly over the wire. No shelling out. No subprocess calls. No external binaries.
The engine controls EDNS0, the DO bit for DNSSEC validation, recursion flags, timeout and retry logic, and parallel resolution across five independent resolvers with majority-agreement consensus. This is native DNS at the packet level.
Each scan launches 20+ concurrent tasks — DNS records, SPF/DMARC/DKIM analysis, DNSSEC chain walking, Certificate Transparency log queries, RDAP registrar lookups, live SMTP/STARTTLS verification, MTA-STS/TLS-RPT/BIMI/CAA checks, DANE/TLSA validation, HTTPS/SVCB records, AI surface scanning, and infrastructure fingerprinting — all in parallel. Every task is individually timed and logged.
The Intelligence Classification & Interpretation Engine (ICIE) transforms raw data into actionable intelligence: posture scoring with CVSS-aligned risk levels, per-section remediation with RFC-cited fixes, and confidence indicators that distinguish observed facts from inferred conclusions.
Verification Commands
The dig, openssl, and curl commands in each report are not how we analyze — they’re how you verify. Every finding maps to a standard command you can run in your own terminal to independently confirm our results.
The transport layer is not the product. The interpretation layer is — SPF policy reasoning, DKIM state analysis, DMARC alignment logic, MX transport security, provider fingerprinting, and cross-record correlation. That’s what 27 years of field experience looks like in code.
No Cache, No Shortcuts
DNS query cache is disabled (TTL=0) — every scan performs live queries. When you change a record and rescan, you see the new state immediately. The only caches retained are defensible: RDAP (24h, rate-limit protection), CT subdomains (1h, append-only historical data), and RFC metadata (24h, reference data).
The Audit Engine
The Intelligence Confidence Audit Engine (ICAE) continuously validates that the Intelligence Engine delivers accurate, RFC-compliant intelligence. Every release runs against a deterministic test suite anchored to specific RFC sections — if analysis accuracy regresses, we know before you do.
RFC-Grounded Test Coverage
129 deterministic test cases across nine protocol families validate analysis accuracy against RFC-specified expected outcomes:
| SPF | 17 cases — RFC 7208 mechanisms, qualifiers, lookup limits, verdict logic, cross-protocol warnings (RFC 7489 §10.1) |
|---|---|
| DMARC | 11 cases — RFC 7489 policy levels, alignment modes, subdomain policy, null MX (RFC 7505), posture classification |
| DNSSEC | 17 cases — RFC 4033 chain validation, tampering verdicts, enterprise DNS classification (RFC 1035) |
Maturity Progression
Each protocol earns a maturity grade based on consecutive passes and sustained accuracy over time:
| Development | < 100 consecutive passes |
|---|---|
| Verified | 100+ consecutive passes |
| Consistent | 500+ passes & 30+ days sustained |
| Gold | 1,000+ passes & 90+ days sustained |
| Gold Master | 5,000+ passes & 180+ days sustained |
Regressions are tracked per protocol with automatic detection. If a previously passing test case fails, it’s flagged immediately — not buried in logs.
Cryptographic Algorithm Transparency
Every algorithm classification cites the governing RFC. No proprietary risk scores — only standards-body guidance.
DNSSEC Algorithms (RFC 8624 / RFC 9157)
| Deprecated | RSAMD5, DSA, ECC-GOST — MUST NOT use |
|---|---|
| Legacy | RSA/SHA-1 — NOT RECOMMENDED |
| Adequate | RSA/SHA-256, RSA/SHA-512 — MUST implement |
| Modern | ECDSA P-256/P-384, Ed25519, Ed448 |
DKIM Key Strength (RFC 8301)
| Deprecated | RSA < 1024-bit — MUST NOT use |
|---|---|
| Weak | RSA 1024-bit — upgrade recommended |
| Adequate | RSA 2048-bit — industry standard |
| Strong | RSA 4096-bit, Ed25519 — future-ready |
Post-quantum DNSSEC standards in active IETF development (draft-sheth-pqc-dnssec-strategy) — no PQC algorithms standardized for DNS yet. All classical algorithms carry this transparency note in reports.
Every Command, Verifiable
Every report includes a “Verify It Yourself” appendix with dig, openssl, and curl commands to independently reproduce every finding — open-source tools available on macOS and Linux, and installable on Windows via WSL or individual packages.
No proprietary scanners. No black boxes. DNS — open standard since 1983.
System Architecture
Interactive diagrams of the request lifecycle, engine internals, email security verdict chain, and package dependencies.
View Architecture Diagrams