Enrichments

Enrichments turn a list of subdomains into a list of subdomains with context. Each enrichment is an optional step a scan runs against discovered subdomains.

The available enrichments

Name	What it does	When to enable
DNS records	Resolves A, AAAA, CNAME, MX, TXT, and SRV records for every discovered subdomain. Surfaces hostnames mentioned in SRV / MX targets that probes might miss.	Almost always. Cheap and high-value.
TLS port check	Tests common TLS-bearing ports (443, 8443, 465, ...). Tells you which subdomains expose TLS services.	When you care about service surface area, not just DNS records.
TLS cert enum	Pulls the TLS certificate from each subdomain that responds, extracts the issuer and the SANs. SANs are a major source of additional subdomain names.	When discovery breadth matters. SANs commonly reveal sibling domains that no probe step catches.
HTTP fingerprint	Issues a baseline HTTP request against each subdomain that responds, captures the Server header, framework hints, and status codes.	When you need a quick "what is running here" pass.
Microsoft 365 tenant	Detects whether the domain is bound to an Office 365 / Entra ID tenant and reports the tenant identifier.	When the target organization is enterprise-ish.
NTLM probe	Sends NTLM authentication probes against the subdomain's HTTP layer. Servers that respond often surface internal AD-style hostnames in the challenge.	When you suspect on-prem Microsoft infrastructure.
RBL check	Checks each subdomain's IP against common blocklists.	When the org's deliverability or hygiene is in scope.
Email security	Pulls SPF, DKIM, and DMARC records for the domain and reports the policy.	When email-security posture is part of what you are evaluating.

What the enrichment page shows

The dashboard's /enrichment view ranks dictionary labels by total scan count and registration count. It is a paginated table mirroring the same ranking the dict-probe step uses internally, so you can see exactly which labels the platform considers most likely.

Per-scan vs default enrichments

You set enrichments per scan when you submit. There is no global "default enrichments" setting today - the scan submit form in the dashboard remembers your last selection.

Enrichment cost

Each enrichment runs as a separate task per discovered subdomain. A scan with all enrichments enabled against a domain with 200 subdomains is significantly more expensive than the same scan with only DNS enrichment. See billing.