DNS

How it works

When someone visits a domain, a DNS lookup resolves the name to an IP address through a chain of resolvers and nameservers. Records like A, MX, and TXT control where the site lives, where its mail goes, and how senders are authenticated. Attackers abuse DNS by registering lookalikes, hijacking records, or pointing dangling subdomains at infrastructure they control.

Our full DNS guide covers the record types and security extensions in depth.

How it relates to brand impersonation

Most domain-based impersonation runs through DNS, from lookalike registrations to hijacked records. Understanding it makes the rest of the domain-abuse glossary click into place.

How nebty helps

nebty watches DNS and registration changes around your brand to catch lookalikes and tampering early. For the fundamentals, see our DNS guide.

The records that matter for abuse

A handful of DNS record types do most of the work, and the same ones show up in abuse. The A and AAAA records point a name at an IPv4 or IPv6 address, so they decide which server a lookalike domain actually serves from. MX records route mail, which is why a freshly registered lookalike suddenly gaining MX records is a sign it is being prepared to send spoofed email. TXT records hold SPF, DKIM, and DMARC policies, the email-authentication data that decides whether spoofed mail gets through. NS records define which nameservers are authoritative, and an unexpected change to them can signal a hijack. You do not need to administer DNS to protect a brand, but knowing which records do what explains why watching for DNS changes around your name catches threats early. Our full DNS guide goes deeper.