# Connector: DNS records (`dns`)
**Purpose**: the DNS posture of an organization's apex domain — hosting migrations (A/AAAA), DNS-provider changes
(NS), mail-provider changes (MX), SPF / DMARC / domain-verification tokens (TXT, `_dmarc`), CA restrictions (CAA),
SOA administrative fields. These are textbook *silent changes*: nobody announces them.
**Sensor URL**: `dns://example.com` (only the host is used). **Sensor type**: DNS, tier D.
**Config**: `records?` (default A, AAAA, NS, MX, TXT, CAA, SOA, DS-via-ANY), `resolvers?` (1.1.1.1, 8.8.8.8, 9.9.9.9),
`includeDmarc?` (true).
**Normalization**: JSON snapshot; every record set sorted, hostnames lower-cased, SOA **serial excluded** (changes
on every zone edit), TXT chunks joined. Missing record types are empty arrays (`ENODATA`), resolver errors are
`{ error: code }` per type; the fetch fails only when every query failed. `extra`: A/AAAA counts, NS, MX, SPF, DMARC, CAA.
**Safety**: the host goes through `isBlockedHostname` (no cluster / private / single-label names); queries go to
public resolvers only, never to the target.
**Known quirks**: `node:dns` has no DS query — DNSSEC presence is approximated from `resolveAny` record types when
the resolver supports ANY (many refuse it: field absent, not an error). Round-robin A records that rotate on every
query (large CDNs) will look like changes: prefer the `www` host's TLS sensor for those and keep DNS on the apex.
**Tests**: `connectors2.test.ts` (`hostOf`). **Verified**: 2026-09-08 on the 77 tier S/A founding domains.