Plain-language explainers, deep technical guides, and step-by-step playbooks for diagnosing, hardening, and understanding DNS — paired with our four investigation tools.
Choose your path
Start with the one closest to your question. Every path leads back to the same articles, organized differently.
Workflow guides for Domain Explorer, Domain Recon, Market Index, and Zone Analyzer.
Plain-language primers on records, server roles, lookups, WHOIS, and registrar basics.
Step-by-step diagnostic flows for resolution failures, mail delivery, and DNSSEC errors.
DNSSEC, cache poisoning, amplification, tunneling, SPF/DMARC, BIMI, and DANE.
Tool reference
Each guide explains what the page is showing, how to read the output, and the constraints that matter when acting on it.
Scan modes, record-type coverage, Sankey graph behavior, score weighting, and resolver privacy boundaries.
Read the guideHostname normalization, evidence and confidence handling, and how CDN-fronted domains are treated conservatively.
Read the guideSector-level posture scores, freshness badges, and quick pivots into company-level Domain Explorer evidence.
Read the guideDrag-in your zone file, filter records, export CSV, and selectively trigger visual verification on web-facing rows.
Read the guideMost asked
Step-by-step diagnostic flows for the questions our users ask most.
Systematic diagnosis when lookups fail for end users or monitoring probes — from delegation to TTL pitfalls.
Start playbookThe DNS-layer causes of mail flow failure — MX, SPF, DKIM, DMARC, PTR, and TLS-RPT all live here.
Start playbookWhen validation fails on some resolvers but not others — chains of trust, key rollovers, and clock skew.
Start playbookTrack down sporadic failures that won't reproduce — anycast routing, response races, and cache divergence.
Start playbookQuick reference
Bookmark this — the records and commands that come up most often in real investigations.
dig commands$ dig example.com A +short
Quick A record lookup with terse output.
$ dig example.com MX
Find the mail exchangers for a domain.
$ dig +trace example.com
Trace delegation from the root downward.
$ dig example.com TXT
SPF / DMARC / verification records.
$ dig DNSKEY example.com +dnssec
Inspect DNSSEC keys and RRSIG signatures.
$ dig @1.1.1.1 example.com
Force a query against a specific resolver.
Browse by topic
Pick a topic to filter the index below — or click again to clear.
Workflow guides for the four DNS Panopticon tools.
5Records, server roles, lookups, WHOIS, registrars.
6SERVFAIL, lame delegation, propagation myths, takeovers.
6DNSSEC, cache poisoning, amplification, SPF/DMARC, BIMI, DANE.
7CAA, SRV, SOA tuning, and TXT beyond SPF.
4Step-by-step diagnostic flows for common failures.
5dig, nslookup, host, DoH testing, WHOIS vs RDAP.
4Resolvers, anycast, hidden primaries, multi-provider.
4Authoritative vs recursive, DNSSEC vs DoH, single vs multi.
4All articles
Every article across product documentation and the DNS reference library — searchable, filterable, and grouped by topic.
Scan modes, weighted scoring, Sankey graph behavior, and resolver privacy boundaries.
Hostname normalization, provider evidence, confidence handling, and CDN caveats.
Local zone parsing, filter workflow, CSV export, and visual verification guard rails.
S&P 500 DNS posture scores, freshness badges, and pivots to company-level evidence.
DNS acquisition, finding engines, and scoring pipeline internals.
Understand lookups, caching, delegation, and why DNS matters.
Review the records you will see most often in live lookups and zone files.
dig, host, nslookup, whois, and delv for everyday troubleshooting.
How recursive, root, TLD, and authoritative servers work together.
What registration data shows, what may be redacted, and where RDAP fits.
What your registrar controls and where that control stops.
Why a resolver returns SERVFAIL even when the name exists.
When NS records point at servers that are not authoritative for the zone.
Why "propagation delays" are usually TTL expiration and resolver policy differences.
Serving different answers internally and externally for the same name.
How dangling CNAME records get exploited and how to harden your DNS lifecycle.
How wildcard records can hide shadow assets and enable abuse.
Injecting forged answers into a resolver's cache by winning the response race.
Open resolvers weaponized as reflectors for volumetric DDoS.
Exfiltrating data through DNS queries to attacker-controlled authorities.
Missing vs broken DNSSEC: different severity, different remediation.
Weak email auth policy that enables sender spoofing.
Inbox logo trust signals with DNS TXT and DMARC prerequisites.
SMTP transport authenticity using TLSA and DNSSEC validation.
Restricting which CAs may issue certificates for your domain.
Publishing service endpoints with priority, weight, and port.
TXT for DKIM, DMARC, verification tokens, and more.
Zone refresh, retry, expire, and negative TTL settings.
Systematic diagnosis when lookups fail for users or monitoring probes.
DNS-layer causes of mail delivery failure.
Isolating network-specific resolution failures.
Tracking down sporadic failures that are hard to reproduce.
When validation fails on some resolvers but not others.
Authoritative queries, trace paths, flags, and record lookups with dig.
When to use each tool and how their output compares.
Testing DoH endpoints with curl and browser developer tools.
Legacy WHOIS protocol versus structured RDAP for registration data.
Iterative lookups, policy enforcement, and caching behavior.
One IP, many sites: routing queries to nearby healthy nodes.
Non-public primaries for zone management with public-facing secondaries.
Resilience through multiple providers and the synchronization tradeoffs.
Source-of-truth publishing versus client-facing resolution and caching.
Data authenticity (DNSSEC) versus transport privacy (DoH).
Simplicity versus resilience in DNS provider architecture.
Wildcard convenience versus explicit-record governance and auditability.
No articles match your search. Try a different term or .
Still need help?
Include the domain, the workflow, or a paste of the zone file you're working with so support can respond faster.