Perform DNS enumeration: A, AAAA, MX, TXT, NS, SOA records. - Identify email security posture: SPF, DKIM, DMARC records. - Map IP ranges and ASN ownership. - Check for DNS zone transfer vulnerabilities.