SKILL / Infrastructure
Plans: Pro & AgencyDNS Posture
Examine public domain records and the infrastructure relationships they indicate.
Read the step-by-step user guideDNS Posture answers the question of how a domain is set up right now: where its website resolves, which service handles its mail, which name servers answer for it and what other records are published. Investigators reach for it when a domain surfaces in a case and they need to understand the infrastructure behind it before pivoting to IP addresses or related hosts. Nexus examines the public records and returns them as evidence-linked findings, each tied to the record retrieved and the time it was observed.
What you get
A dated summary of a domain’s public records and the hosting, mail and name-service relationships they show.
Using DNS Posture in an investigation
The value is in the relationships the records indicate. A shared mail service, a name server used by several domains, or a hosting address that also serves other sites all become documented observations an investigator can follow. Nexus labels each relationship as supported by the record or as a possible association, and it flags records that were absent or could not be resolved as information gaps rather than treating them as evidence of anything on their own.
Because the records are captured with a timestamp, the findings serve as a dated snapshot that can be preserved in the case, added to the relationship graph as domain, host and address entities, and cited in a brief or PDF report. DNS Posture is a natural companion to Domain Registration Intelligence, Reverse IP Relationships and IP Network Location when the objective is to map the footprint of an organization or a suspicious site.
Example objectives
Run the Skill directly, or describe the objective in your own words — these are the kinds of questions it is built to answer.
Ask Nexus
“Where does this domain’s website resolve, and which service handles its email?”
Ask Nexus
“Do these two domains share name servers or hosting, and what does the record actually show?”
Ask Nexus
“What public records are published for this domain, and which expected records are missing?”
How DNS Posture fits the investigation
A Skill is one move inside a case. The findings stay in the case file, where the evidence behind them can be checked, graphed and reported.
- 01
Choose or describe
Pick the Skill from the Skill Library, or describe the objective in your own words and let Nexus work out which Skills fit the question.
- 02
Review the evidence
Open the evidence record behind any finding and read the original public source before you rely on what it says.
- 03
Add to the case graph
Promote the people, organizations and identifiers you accept into the case relationship graph, straight from their evidence records.
- 04
Brief and report
Turn the case into a BLUF situation brief and, on Pro and Agency, into a structured PDF report with chain of custody.
Evidence before conclusions
What DNS Posture cannot establish
Nexus keeps supported findings, possible matches, contradictions and information gaps apart instead of blending them into one narrative. These are the boundaries DNS Posture states up front.
- Public records are time-sensitive and may change after retrieval, so DNS Posture findings are a dated snapshot rather than a permanent state.
- Shared name servers, mail services or hosting addresses indicate a possible relationship, not common ownership or control.
- A record that does not resolve is an information gap, not evidence that a service or domain is inactive.
Best for
Teams that reach for DNS Posture most often.
Related OSINT concepts
The vocabulary this Skill works in, defined in the glossary.
Related Skills
Skills investigators commonly run next, in the same case.
Frequently asked questions
What does DNS Posture show for a domain?
DNS Posture in Nexus returns the domain’s public records as they were observed: the addresses its website resolves to, the mail service its records point to, the name servers that answer for it and any other published records. Each record is an evidence-linked finding with a timestamp, and the relationships those records indicate, such as shared hosting or a common mail service, are labeled as supported or possible.
Does DNS Posture prove two domains belong to the same organization?
DNS Posture does not prove common ownership. Two domains that share name servers, a mail service or a hosting address may belong to the same organization, or they may simply use the same popular service. Nexus reports the overlap as a possible relationship and leaves the conclusion to the investigator, who can corroborate it with Domain Registration Intelligence, Reverse IP Relationships or other case evidence.
Which Nexus plan includes DNS Posture?
DNS Posture is included in the Skill Library on the Pro and Agency plans. Pro unlocks 43 of the 47 investigative Skills, including DNS Posture, Domain Registration Intelligence, Reverse IP Relationships, IP Network Location and Breach Exposure Search; Agency includes all 47.
Can DNS Posture tell me how a domain was configured in the past?
DNS Posture examines the public records available at the time it runs and preserves them as a dated snapshot in the case. Nexus does not monitor a domain or alert on changes. An investigator who needs to document change over time can run DNS Posture again later and compare the two snapshots, each of which remains linked to its own evidence record.