Public records do not reveal an entire DNS zone

Understand the difference between querying one name and enumerating subdomains.

Start with an exact name

A lookup for example.com is different from a lookup for app.example.com. DNS answers a question about a specific name and type. Looking up the apex does not list every subdomain; “All types” covers common types for the name you entered.

Text records are public too

TXT often carries SPF policies or ownership verification. Do not put passwords, private tokens or internal instructions in public DNS. Before removing an old verification record, check whether a service still depends on it. Its appearance alone cannot establish whether it remains in use.

Know what a result proves

A returned record shows what the selected recursive resolver obtained at that time. An empty answer does not prove a subdomain never existed or that the domain has no other services. For a complete configuration inventory, use a DNS control panel you are authorized to access.

This guide explains public DNS responses. Before changing production settings, check the documentation for your current domain and hosting providers.