MX answers where inbound mail goes
MX records are excellent evidence for the mailbox or filtering service that receives mail for a domain. They do not identify every service allowed to send mail on behalf of that domain. A company can receive through Microsoft 365 and send transactional mail through several unrelated platforms.
SPF adds outbound authorization evidence
SPF includes can reveal providers that are authorized for an envelope-sender domain. Recursive includes matter because a vendor may be hidden behind a higher-level policy. However, an SPF authorization can remain after the service is no longer active, so it is evidence of configuration rather than proof of current traffic.
DKIM and CNAME fingerprints add another layer
Known selector and CNAME patterns can identify some sending vendors even when SPF is shared or minimal. Selector enumeration is impossible through normal DNS, so provider detection should state the limits of what was discoverable rather than claiming a complete inventory.
Use confidence, not certainty
Correlate MX, SPF, DKIM and other public records and explain which signal supported each provider label. This makes the result useful for audits and migrations without pretending that passive DNS can see tenant configuration or actual message volume.
Verify the evidence
Use the Email Infrastructure Digital Twin to establish the public control plane, then inspect message-level evidence with Email Header Forensics.