Cluster
What One Domain Reveals
A single domain leaks more than its owners think. DNS records name the SaaS vendors, MX points at the email provider, the TLS certificate lists every SAN, and llms.txt declares AI intent. This cluster walks each signal on its own, then shows how one sniff_domain call reads them as one correlated dossier instead of five scattered lookups.
5 questions about what one domain reveals
- How do you find a company's SaaS stack from its DNS?
You find a company's SaaS stack in DNS by reading the MX, TXT, CNAME, DKIM, and DMARC records, each of which names an authorized or verified vendor.
- What can MX records tell you about a company?
MX records name the mail servers a domain uses, exposing its email provider, any security gateway in front, and whether the domain accepts mail at all.
- What do DNS TXT records reveal about a company?
DNS TXT records list a company's SPF includes, DMARC policy, and SaaS verification tokens. Each string names a vendor the company set up, no auth required.
- What does a TLS certificate reveal about a domain?
A TLS certificate reveals the issuing CA, every hostname in its SANs, the validity window, and infrastructure clues about where a domain is hosted.
- What does llms.txt tell you about a company?
llms.txt is a curated markdown map a company publishes for LLMs. It signals AI-awareness, and its links reveal canonical docs, products, and API surface.
Related clusters
Frequently asked questions
How much can one domain actually reveal?
A lot, without a single login or key: the SaaS vendors named in DNS TXT records, the email provider behind the MX, the hosting org and CDN, every hostname on the TLS certificate, the front-end and analytics stack, and whether the company ships AI (model providers, SDKs, vector stores, llms.txt). One sniff_domain call returns all five layers correlated, so you read them as one picture rather than five disconnected lookups.
Why read these signals together instead of one at a time?
Because correlation is the value a single-layer tool cannot give you. MX plus DNS TXT plus TLS SANs plus page fingerprints tell a story no lookup does alone: who runs their email, what they host, which vendors they pay, whether they are experimenting with AI or shipping it. An agent stitching five separate MCPs pays for five round trips and still has to fuse the results itself. Bassethound sniffs all of it in one keyless request and returns it already fused.
Sniff a domain.
Run sniff_domain on any site and read its five-layer dossier in one call.