What your DNS reveals about the software you use

Why DNS keeps a list of your tools

Software that sends email as you, or that needs to prove you own your domain, has to ask you to publish something in DNS. A marketing platform wants an SPF entry and a signing key. A document-signing service wants a verification code. A Microsoft 365 rollout adds a handful of helper records. Each is a small, one-off change that someone makes in a hurry.

Years later, the records are still there. That makes your DNS zone an unplanned, public history of the software your business has used. It's useful for you, because it's a fast way to find tools nobody's tracking. It's also why tidying it matters: a record for a service you cancelled can still give that service, or whoever takes over the account, standing to act as your domain.

Four places to look

The mail routing itself also tells you the platform: an MX record at *.mail.protection.outlook.com is Microsoft 365, and aspmx.l.google.com is Google Workspace.

Cheat sheet: common services and their records

The patterns below are the usual ones, but they vary by plan and setup, so treat a match as a strong hint rather than proof.

Why it matters

• Offboarding. When a tool is cancelled, nobody thinks to remove its DNS records. Anyone who later controls that vendor account might be able to send mail that appears to come from your domain.
• The SPF 10-lookup limit. Every include costs a lookup, and nested includes count too. Stale ones push you towards the limit, and over it, SPF fails for all your mail.
• DMARC readiness. You can't safely move to p=reject until every legitimate sender is accounted for. Your SPF includes and DKIM selectors are the first draft of that list.
• Supplier and privacy risk. The list shows which outside companies handle email or data on your behalf, which is exactly what a privacy or supplier review needs.
• Shadow IT. Tools a team signed up for without telling IT show up here before they show up on any spreadsheet.
• Insurance and audits. Questionnaires increasingly ask which third parties send email as you, and whether DMARC is enforced.

Build your inventory in five steps

1. Export your records. Copy the TXT records for your domain, your DMARC record, and the DKIM selectors that exist. Your DNS host's control panel, or our DNS Audit, can list them.
2. Name every entry. For each include, selector and verification record, write down which service it belongs to. Search the record text if you don't recognise it.
3. Find an owner. Next to each service, write who in the business uses it, and who pays for it.
4. Mark what's unused. Anything with no owner, no invoice or no recent activity goes on a removal list.
5. Remove carefully. Close or confirm the vendor account first, then delete the DNS record. Remove one at a time, watch your email, and keep a note of what you changed so you can restore it.

What DNS can't tell you

• Whether a tool is still used. A verification record only shows the service was connected once.
• Tools that don't touch DNS. Most software, including accounting, project and file-sharing tools that don't send mail as you, leaves no trace here.
• How well a tool is secured. Whether it uses multi-factor authentication, who has admin access and what data it holds all live inside the tool.
• Who's behind a name. Different vendors can share a platform or use similar names, so treat matches as hints.

That's why an inventory built from DNS is a good starting point, and why the next step is always a conversation with the people who run each tool. For broader coverage of what DNS says about your email, website and exposed systems, see What your DNS records say about your business.

Check your own domain

Resolve-DnsName globalsoc.com.au -Type TXT | Select -Expand Strings          # SPF and verification records
Resolve-DnsName _dmarc.globalsoc.com.au -Type TXT | Select -Expand Strings # DMARC and its reporting address
Resolve-DnsName selector1._domainkey.yourdomain.com.au -Type CNAME        # try a DKIM selector

Or run our free DNS Audit: its Raw records tab shows all your TXT records in one place, and its Hygiene & exposure section lists leftover verification records. This guide explains how to read the rest of the report.