The short answer
The Domain Name System (DNS) is the internet's directory. It translates a domain name such as nebty-id.com into the IP addresses and other records that computers need to load a website or deliver an email. DNS is a distributed hierarchy: the root zone delegates to top-level domains like .com or .de, and those delegate to the nameservers of each individual domain. For security teams, DNS is also where an attack becomes visible first, because a phishing domain needs DNS records before it can serve a page or send a single email.
Most people never notice DNS until it breaks. On 5 May 2026, a signing error at DENIC made .de domains unreachable for about three hours for every resolver that checks signatures, including domains that had never enabled DNSSEC at all (DENIC final report). Attackers notice it all the time. Every lookalike domain, every phishing kit and every fake shop starts with a registration and a handful of DNS records, and those records are public.
This guide explains how resolution works, which record types matter, how DNS data exposes abuse, and how to look a domain up yourself. It is written for people in security, fraud and brand protection who need enough DNS to read a lookup result and act on it.
What is DNS, in simple terms?
Computers talk to each other by IP address, people remember names. DNS connects the two. It was specified in RFC 1034 and RFC 1035 in November 1987, and the basic design has not changed since: no single server knows every name, each level of the hierarchy only knows who is responsible for the level below.
A domain name is read from right to left. In shop.example.com, com is the top-level domain (TLD), example is the second-level domain that someone registered, and shop is a subdomain the owner created. The scale is large and still growing:
- 401.6 million domain names were registered worldwide at the end of June 2026, 8.1% more than a year earlier, according to the Domain Name Industry Brief.
- .de passed 18 million registered domains in June 2026, according to DENIC.
- The root zone holds more than 1,400 TLDs, and ICANN's 2026 application round closed on 12 August with more than 1,600 applications for new ones.
Every new TLD is another place to register a name that looks like yours. Our glossary entry on DNS has the short version of this article.
How does a DNS lookup work?
When you open shop.example.com, your device asks a recursive resolver, usually run by your internet provider, your company or a public service such as Cloudflare's 1.1.1.1 or Google's 8.8.8.8. If the resolver has no cached answer, it walks down the hierarchy:
-
Your device asks the recursive resolver
"What is the IP address of shop.example.com?" The browser and operating system check their own caches first.
-
The resolver asks a root server
The root answers with a referral: "Ask the .com nameservers." There are 13 root server identities, run by 12 organisations and served from more than 1,900 locations (root-servers.org).
-
The resolver asks the TLD nameserver
The .com servers do not know the IP either. They answer with the NS records of example.com, the nameservers the registrar entered for the domain.
-
The resolver asks the authoritative nameserver
This server holds the zone of example.com and returns the actual record, for example an A record with an IPv4 address.
-
The answer is cached and returned
The resolver keeps the answer for as long as the record's TTL allows and hands it to your device, which connects to that IP.
Caching is why DNS is fast and also why changes take time to spread: a resolver that cached a record with a one-day TTL keeps serving the old answer for up to a day. The same applies to a takedown: once a phishing domain is suspended, new lookups fail right away, but resolvers that cached the old answer keep serving it until the TTL runs out.
Which DNS record types should you know?
A domain's zone is a list of resource records. These are the ones that come up when you investigate a suspicious domain:
| Record | What it holds | Why it matters for security |
|---|---|---|
| A | IPv4 address of the domain | Leads to the hosting provider, the first contact for a takedown |
| AAAA | IPv6 address (RFC 3596) | Same as A; check both, the IPv6 host can differ |
| CNAME | Alias pointing to another name | A CNAME to a deleted cloud resource allows a subdomain takeover |
| MX | Mail servers that receive email for the domain | MX records on a lookalike domain mean it is ready for email, a warning sign for invoice fraud |
| TXT | Free text, used for SPF, DKIM, DMARC and ownership checks | Shows whether a domain protects its mail against spoofing |
| NS | Authoritative nameservers of the domain | Reveals the DNS provider; an unexpected NS change is a sign of hijacking |
| SOA | Start of authority: primary server, contact, serial number, timers | The serial changes on every zone edit, useful for spotting changes |
| CAA | Which certificate authorities may issue certificates (RFC 8659) | Stops other CAs from issuing for your domain; checking it is mandatory for CAs since September 2017 |
Where do SPF, DKIM and DMARC live?
All three are TXT records. SPF (RFC 7208) sits on the domain itself and lists the servers allowed to send its mail. DKIM (RFC 6376) publishes a public key under a selector, so receivers can check the signature on each message. DMARC sits under _dmarc and tells receivers what to do when SPF or DKIM fail. In May 2026 the IETF published RFC 9989, which replaces the 2015 DMARC specification and makes DMARC a standards-track protocol. Existing v=DMARC1 records keep working.
example.com. TXT "v=spf1 include:_spf.mailer.example -all"
s1._domainkey.example.com. TXT "v=DKIM1; k=rsa; p=MIIBIjANBgkq..."
_dmarc.example.com. TXT "v=DMARC1; p=reject; rua=mailto:[email protected]"
That last point is easy to miss. A strict DMARC policy stops attackers from sending mail as your own domain, which is why they register a lookalike and set up its mail records instead. More on this in our article on email spoofing and the glossary entry on DMARC.
Why does DNS matter for detecting phishing and brand abuse?
An attacker can hide who they are, but not that their domain exists. Registrations and the records behind them are the earliest public trace of a campaign, often days before the first email goes out.
Newly registered domains
Most phishing domains are bought for the purpose. Interisle's Phishing Landscape 2025 found that 77% of the domains used for phishing between May 2024 and April 2025 were registered by the criminals, and 37% came through bulk registration services. An older Unit 42 study from 2019 classified more than 70% of domains younger than 32 days as malicious, suspicious or not safe for work. The daily zone files that gTLD registries provide through ICANN's Centralized Zone Data Service list every delegated domain, which is how lookalike domains can be spotted on the day they appear.
MX records on a lookalike domain
A lookalike domain with no website but working MX records is usually being prepared for email: fake invoices, changed bank details, a message that seems to come from your CFO. Business email compromise caused about 3.05 billion US dollars in reported losses in 2025 according to the FBI's Internet Crime Complaint Center, second only to investment fraud. When a domain that imitates yours gets MX records, tell your finance team before the first email lands. Our BEC guide covers the process side.
Fast flux
In fast flux, the operator rotates the IP addresses behind a domain every few minutes, often across hacked machines, and in the double flux variant rotates the nameservers too. Blocking one IP does nothing. In April 2025, CISA, the NSA, the FBI and partner agencies from Australia, Canada and New Zealand called it a national security threat and asked DNS providers to detect and block it. Tell-tale signs are very short TTLs, many A records spread over unrelated networks, and frequent changes.
DNS hijacking
Here the attacker changes the records of a real domain, usually after stealing the login at the registrar or DNS provider, and points the A, MX or NS records to their own servers. Visitors and email go to the attacker under your genuine name. A wave of such attacks led CISA to issue Emergency Directive 19-01 in January 2019, ordering US federal agencies to audit their DNS records and secure the accounts that manage them. Multi-factor authentication on registrar accounts, a registry lock for important domains and alerts on NS changes are the standard defences. See domain hijacking in our glossary.
What is DNSSEC, and what does it not protect against?
DNSSEC (RFC 4033 to 4035, 2005) adds digital signatures to DNS answers. A validating resolver can check the chain of signatures from the root down to the domain and reject any answer that was forged or altered, which stops cache poisoning attacks. The root zone has been signed since 15 July 2010, and DENIC signed .de on 31 May 2011.
DNSSEC does not encrypt anything and does not judge whether a domain is honest. A lookalike domain registered by an attacker can carry perfectly valid signatures. It also adds an operational risk, as the .de outage in May 2026 showed: invalid signatures look exactly like an attack to a validating resolver, so the zone becomes unreachable. Encryption of the queries themselves is a separate layer: DNS over TLS (RFC 7858) and DNS over HTTPS (RFC 8484) hide lookups from anyone on the network path.
How can you look up a domain's DNS and hosting yourself?
For a quick answer, paste the domain into our free Who is hosting lookup. It shows the hosting provider, IP address, ASN, registrar, nameservers and mail servers in one view. On the command line, dig (macOS, Linux) or nslookup (Windows) do the same:
dig +short A suspicious-domain.example
dig +short MX suspicious-domain.example
dig +short NS suspicious-domain.example
dig +short TXT _dmarc.suspicious-domain.example
nslookup -type=mx suspicious-domain.example
Registration data is not in DNS. For generic TLDs, ICANN Lookup queries RDAP, which replaced WHOIS on 28 January 2025, and shows the registrar, creation date and abuse contact. For .de, use the DENIC WHOIS: it names the managing DENIC member and, since 28 January 2026, also shows the contact details of registrants that are companies, following the German NIS2 implementation.
When you read the results, these combinations deserve a closer look:
- A domain created in the last few days that contains your name or a close misspelling of it.
- MX records but no website, or a parked page, on a domain that imitates yours.
- An A record in the IP range of a CDN such as Cloudflare: the real host is hidden behind it.
- Very short TTLs and A records that change between two queries a few minutes apart.
- On your own domains: NS or MX records you did not set.
Do not open a suspicious site in your work browser to see what it does. A website scan loads it in a sandbox and records the page together with its DNS and hosting data; our guide to investigating a suspicious website safely explains the method. If the domain turns out to be a phishing site or a fake shop, the website takedown guide shows who to report it to.
What does this mean for protecting your brand?
Checking single domains by hand works for an incident. It does not scale to 400 million registrations and more than 1,400 TLDs. Domain monitoring takes over the first step: nebty screens new registrations worldwide for typos, lookalike characters, added words and other extensions of your name, scores each finding and alerts your team. The dangerous ones can go straight to a takedown. The 14-day trial shows the lookalikes that already exist around your domain.
Frequently asked questions
What does DNS stand for and what does it do?
DNS stands for Domain Name System. It translates domain names such as nebty-id.com into the IP addresses and other records that computers need to load a website or deliver email. It works as a distributed hierarchy of nameservers, defined in RFC 1034 and RFC 1035 from 1987.
What is the difference between a registrar, a DNS provider and a host?
The registrar sells and manages the domain name and tells the registry which nameservers are responsible for it. The DNS provider runs those nameservers and answers queries with the records you set. The host runs the server that the A or AAAA record points to. One company can do all three, but often they are different, which matters when you need to report abuse.
What is a TTL in DNS?
The time to live, set per record in seconds, tells resolvers how long they may cache an answer. A TTL of 3600 means a resolver can reuse the answer for an hour before asking again. Very short TTLs on a domain that keeps changing its IP addresses are one of the signs of fast flux hosting.
Can DNS show who owns a domain?
No. DNS records show where a domain points, not who registered it. Registration data comes from RDAP, which replaced WHOIS for generic top-level domains in January 2025, or from the registry of a country-code domain. For privately registered domains the owner is usually redacted, but the registrar and its abuse contact are listed.
Does DNSSEC protect against phishing?
Only against one kind. DNSSEC proves that an answer really comes from the domain's nameservers and was not altered on the way, which stops cache poisoning. It does nothing against a lookalike domain: a phishing domain registered by the attacker can be perfectly DNSSEC signed.
How do attackers abuse DNS?
Mostly by registering lookalike domains and pointing them at phishing pages or mail servers, by changing the records of a real domain after stealing the account that manages them (DNS hijacking), by taking over subdomains whose CNAME points to a deleted service, and by rotating IP addresses quickly (fast flux) so that blocking a single server has no effect.
