Direct answer
Public DNS can help inventory names and the services they point to. Record the queried name, record type, response and observation time, then verify the owner and service purpose; DNS alone does not establish a vulnerability or authorization to test.
Define the owned domain set
Use the organization's inventory and owner confirmation to choose the names to review. A domain discovered in a third-party source may be a candidate, not a confirmed organizational asset. Record the environment and business owner where known.
Reference: NIST SP 800-115: Technical information security testing.
Record the response and context
Different records answer different questions: address records can point to an IP address, aliases can point to another name, and mail exchanger records indicate mail routing. Record the exact name and type requested, the answer, collection time and resolver or source where appropriate.
DNS responses can vary by location and cache state. A missing answer during one query is not proof that a service never exists.
Reference: RFC 1034: Domain names: concepts and facilities.
Correlate with asset ownership
Compare an unfamiliar name with the asset inventory and consult the responsible team. An external provider may legitimately host the service. Do not treat an address shared with other customers as permission to examine those customers.
- Mark uncertain ownership explicitly.
- Separate observed record data from a proposed risk.
- Review an unexpected change with the DNS or service owner before modifying it.
Plan maintenance and retesting
After an approved DNS change, repeat the same query and compare expected results, allowing for relevant caching and provider behavior. Preserve before-and-after evidence and verify that necessary services still function. Investigate inconsistent results rather than declaring the issue fixed from a single resolver.
Assessment limits
Public DNS is a partial, time-dependent view and cannot establish all assets, service ownership, exploitability or global reachability. More complete review needs authoritative inventory and the service owner's context.
Frequently asked questions
Does a DNS result prove a service is vulnerable?
No. It is a configuration observation. Assess ownership, intended use and the relevant control before drawing a security conclusion.
Does no DNS answer prove a host does not exist?
No. Configuration, record type, caching or location can affect a result; record the test and its limits.
Primary sources and further reading
These guides combine published security guidance with practical assessment planning. Adapt checks to the owner's policy, environment, and authorized scope.
This guide was prepared with AI assistance using the linked sources and illustrative examples. Check current vendor guidance and your environment before making changes.