tools-only DNS Intelligence Skill
Purpose
Extract technology signals from DNS records including MX, TXT, NS, CNAME, and SRV records.
Operations
1. query_mx_records
Identify email provider from MX records.
Command:
dig +short MX {domain}
MX Record Detection Patterns:
{
"aspmx.l.google.com": {"service": "Google Workspace", "confidence": 95},
"googlemail.com": {"service": "Google Workspace", "confidence": 95},
"mail.protection.outlook.com": {"service": "Microsoft 365", "confidence": 95},
"pphosted.com": {"service": "Proofpoint", "confidence": 95},
"mimecast.com": {"service": "Mimecast", "confidence": 95},
"mailgun.org": {"service": "Mailgun", "confidence": 95},
"sendgrid.net": {"service": "SendGrid", "confidence": 95},
"amazonses.com": {"service": "AWS SES", "confidence": 95},
"mx.zoho.com": {"service": "Zoho Mail", "confidence": 95},
"secureserver.net": {"service": "GoDaddy Email", "confidence": 90},
"emailsrvr.com": {"service": "Rackspace Email", "confidence": 90},
"messagelabs.com": {"service": "Symantec Email Security", "confidence": 90},
"barracudanetworks.com": {"service": "Barracuda Email Security", "confidence": 90}
}
2. query_txt_records
Find service verification tokens in TXT records.
Command:
dig +short TXT {domain}
TXT Record Detection Patterns:
{
"google-site-verification=": {"service": "Google Search Console / Workspace", "confidence": 95},
"MS=ms": {"service": "Microsoft 365", "confidence": 95},
"facebook-domain-verification=": {"service": "Meta Business Suite", "confidence": 95},
"atlassian-domain-verification=": {"service": "Jira/Confluence Cloud", "confidence": 95},
"stripe-verification=": {"service": "Stripe", "confidence": 95},
"docusign=": {"service": "DocuSign", "confidence": 95},
"slack-domain-verification=": {"service": "Slack", "confidence": 95},
"zendesk-domain-verification=": {"service": "Zendesk", "confidence": 95},
"hubspot-developer-verification=": {"service": "HubSpot", "confidence": 95},
"apple-domain-verification=": {"service": "Apple Business", "confidence": 95},
"amazonses:": {"service": "AWS SES", "confidence": 95},
"mailchimp": {"service": "Mailchimp", "confidence": 90},
"pardot": {"service": "Salesforce Pardot", "confidence": 95},
"v=spf1": {"service": "SPF Record", "confidence": 100},
"v=DMARC1": {"service": "DMARC", "confidence": 100},
"DKIM1": {"service": "DKIM", "confidence": 100},
"have-i-been-pwned-verification=": {"service": "Have I Been Pwned", "confidence": 95},
"status-page-domain-verification=": {"service": "Statuspage", "confidence": 95},
"1password-site-verification=": {"service": "1Password", "confidence": 95}
}
3. query_ns_records
Identify DNS provider from NS records.
Command:
dig +short NS {domain}
NS Record Detection Patterns:
{
"cloudflare.com": {"service": "Cloudflare DNS", "confidence": 95},
"awsdns": {"service": "AWS Route 53", "confidence": 95},
"azure-dns.com": {"service": "Azure DNS", "confidence": 95},
"googledomains.com": {"service": "Google Domains DNS", "confidence": 95},
"dns.google": {"service": "Google Cloud DNS", "confidence": 95},
"ns-cloud": {"service": "Google Cloud DNS", "confidence": 90},
"digitalocean.com": {"service": "DigitalOcean DNS", "confidence": 95},
"domaincontrol.com": {"service": "GoDaddy DNS", "confidence": 95},
"name.com": {"service": "Name.com DNS", "confidence": 95},
"namecheap.com": {"service": "Namecheap DNS", "confidence": 95},
"dynect.net": {"service": "Oracle Dyn DNS", "confidence": 95},
"nsone.net": {"service": "NS1 DNS", "confidence": 95},
"ultradns.com": {"service": "UltraDNS", "confidence": 95},
"constellix.com": {"service": "Constellix DNS", "confidence": 95}
}
4. query_cname_records
Detect CDN/hosting delegations from CNAME records.
Command:
dig +short CNAME {subdomain}.{domain}
CNAME Detection Patterns:
{
"cloudfront.net": {"tech": "AWS CloudFront", "type": "CDN", "confidence": 95},
"azureedge.net": {"tech": "Azure CDN", "type": "CDN", "confidence": 95},
"akamaiedge.net": {"tech": "Akamai", "type": "CDN", "confidence": 95},
"fastly.net": {"tech": "Fastly", "type": "CDN", "confidence": 95},
"cdn.cloudflare.net": {"tech": "Cloudflare CDN", "type": "CDN", "confidence": 95},
"netlify.app": {"tech": "Netlify", "type": "Hosting", "confidence": 95},
"vercel.app": {"tech": "Vercel", "type": "Hosting", "confidence": 95},
"vercel-dns.com": {"tech": "Vercel", "type": "Hosting", "confidence": 95},
"herokuapp.com": {"tech": "Heroku", "type": "PaaS", "confidence": 95},
"pages.dev": {"tech": "Cloudflare Pages", "type": "Hosting", "confidence": 95},
"firebaseapp.com": {"tech": "Firebase Hosting", "type": "Hosting", "confidence": 95},
"web.app": {"tech": "Firebase Hosting", "type": "Hosting", "confidence": 95},
"shopify.com": {"tech": "Shopify", "type": "E-commerce", "confidence": 95},
"myshopify.com": {"tech": "Shopify", "type": "E-commerce", "confidence": 95},
"squarespace.com": {"tech": "Squarespace", "type": "Website Builder", "confidence": 95},
"wixsite.com": {"tech": "Wix", "type": "Website Builder", "confidence": 95},
"ghost.io": {"tech": "Ghost", "type": "CMS", "confidence": 95},
"webflow.io": {"tech": "Webflow", "type": "Website Builder", "confidence": 95},
"zendesk.com": {"tech": "Zendesk", "type": "Support", "confidence": 95},
"salesforce.com": {"tech": "Salesforce", "type": "CRM", "confidence": 95}
}
5. query_srv_records
Find enterprise services from SRV records.
Command:
dig +short SRV _sip._tcp.{domain}
dig +short SRV _sipfederationtls._tcp.{domain}
dig +short SRV _xmpp-server._tcp.{domain}
SRV Record Detection Patterns:
{
"_sip._tcp": {"service": "SIP/VoIP", "confidence": 80},
"_sipfederationtls._tcp": {"service": "Microsoft Teams/Skype for Business", "confidence": 95},
"_xmpp-server._tcp": {"service": "XMPP Server (Jabber)", "confidence": 90},
"_caldav._tcp": {"service": "CalDAV Calendar", "confidence": 85},
"_carddav._tcp": {"service": "CardDAV Contacts", "confidence": 85},
"_ldap._tcp": {"service": "LDAP Directory", "confidence": 80}
}
Output
{
"skill": "dns_intelligence",
"domain": "string",
"results": {
"mx_records": [
{
"priority": "number",
"exchange": "string",
"service_detected": "Google Workspace",
"confidence": 95
}
],
"txt_records": [
{
"value": "string",
"service_detected": "string",
"record_type": "verification|spf|dkim|dmarc|other",
"confidence": "number"
}
],
"ns_records": [
{
"nameserver": "string",
"service_detected": "string",
"confidence": "number"
}
],
"cname_records": [
{
"subdomain": "string",
"target": "string",
"service_detected": "string",
"service_type": "CDN|Hosting|PaaS|Other",
"confidence": "number"
}
],
"srv_records": [
{
"service": "string",
"protocol": "string",
"target": "string",
"service_detected": "string",
"confidence": "number"
}
],
"services_summary": {
"email_provider": "string",
"dns_provider": "string",
"cdn_provider": "string",
"hosting_provider": "string",
"third_party_services": ["array"]
}
},
"evidence": [
{
"type": "dns_record",
"record_type": "MX|TXT|NS|CNAME|SRV",
"query": "string",
"response": "string",
"timestamp": "ISO-8601"
}
]
}
Rate Limiting
- DNS queries: No hard limit (local resolver)
- 2 second delay between batches of queries
- Respect DNS TTL values
Error Handling
- NXDOMAIN: Record doesn't exist (not an error)
- SERVFAIL: DNS server error (retry once)
- Timeout: Retry with backup resolver
- Continue with partial results on failures
Security Considerations
- Use public DNS resolvers only
- Do not attempt zone transfers
- Log all queries for audit trail
- Cache results respecting TTL