# Interpret DNS signals

> How to read the DNS, mail and certificate details on a domain page and use them as an extra signal alongside the Risk Score.

This guide shows you how to read a domain’s DNS details and use them as one more signal when you judge a finding. The red numbers in the screenshots match the numbers in each step.

## Before you start

You need an account with a brand that has domain findings, or a domain to look at in the demo. No DNS expertise is required.

## Steps

1. **Open the domain.** In the **Domains** tab (1) of the brand (Domain Monitoring), select the domain you want to look at (2).

   ![Domains list of the brand Solara Finance with the Domains menu entry marked 1 and the domain solara-finance-secure-login.com marked 2](https://docs.nebty-id.com/images/docs/guides/en/interpret-dns-signals/1-open-domain.webp)

2. **Find the DNS details.** There is no separate DNS tab. Scroll down the domain page, below the screenshot of the site, to three panels side by side: **DNS** (1), **Mail** (2) and **SSL Certificate** (3). nebty has already collected this information, so you do not have to look it up yourself. **DNS** lists the A Records, the IP addresses the domain points to. **Mail** lists the MX Records, the mail servers of the domain. **SSL Certificate** shows the certificate details and the dates it is valid (line **Valid**). An organization named there is not proof of the website operator’s identity.

   ![Domain detail page scrolled to the three panels DNS marked 1, Mail marked 2 and SSL Certificate marked 3](https://docs.nebty-id.com/images/docs/guides/en/interpret-dns-signals/2-dns-sections.webp)

3. **Check the mail records.** MX Records in the **Mail** panel (1) mean the domain is set up to receive email. Here the domain has one mail server with priority 10.

   ![Mail panel with an MX record marked as 1](https://docs.nebty-id.com/images/docs/guides/en/interpret-dns-signals/3-mail-records.webp)

   Without mail records, the panel says that no mail servers were found (1).

   ![Mail panel of another domain with the message that no mail servers were found, marked as 1](https://docs.nebty-id.com/images/docs/guides/en/interpret-dns-signals/4-no-mail-records.webp)

4. **Check the certificate.** In the **SSL Certificate** panel (1), look at the **Valid** line. It shows the start and end of the certificate’s validity period. Compare the start with **First detected** at the top of the page for context. Neither date tells you when the domain was registered; a certificate can also be renewed for an existing site.

   ![SSL Certificate panel with the certificate name, the organization and the validity period marked as 1](https://docs.nebty-id.com/images/docs/guides/en/interpret-dns-signals/5-certificate.webp)

5. **Weigh what you see alongside the Risk Score and the AI Verdict**, not instead of them. Look at the verdict (1), the score (2) and the reasons (3) first. Two details can add context:

   - **MX records** identify mail servers intended to receive email for the domain. They do not establish whether it can send email, and their absence does not rule out sending. Check the domain’s relationship to your brand before deciding whether it is a threat.
   - **Certificate validity dates** help you place the captured site’s HTTPS configuration in time. They do not establish domain age or malicious intent.

   ![Domain detail page with the AI Verdict marked 1, the Risk Score marked 2 and the box Why the model flagged this marked 3](https://docs.nebty-id.com/images/docs/guides/en/interpret-dns-signals/6-weigh-signals.webp)

## What happens next

DNS details describe how a domain is set up, not who is behind it or what it will be used for. A domain with no active mail records is not automatically safe, and one with a fresh certificate is not automatically malicious on that basis alone. Treat these details as extra context for your triage decision, alongside the Risk Score and the AI Verdict, not as a verdict by themselves.

Related: [Domain Monitoring](https://docs.nebty-id.com/features/domain-monitoring/).

[Open a domain detail in the demo (opens the public demo with sample data)](https://dash.nebty.de/demo/brands/demo-brand-1/domains/d-2)