SecurityTrails, now part of Recorded Future, is a DNS and domain intelligence platform that maintains one of the largest historical DNS databases in the world. MAGO is a domain intelligence platform that combines DNS data with multiple other OSINT sources through automated reconnaissance workflows. Both focus on domain intelligence, but they approach it differently.
What SecurityTrails Does
SecurityTrails has been collecting DNS data since 2008, building a historical database of over 3 billion current DNS records and trillions of historical records. Its core product lets you look up any domain's complete DNS history: A records, MX records, NS records, SOA, TXT, and how they have changed over time. The Associated Domains feature finds other domains sharing the same infrastructure.
Since its acquisition by Recorded Future in 2022, SecurityTrails has integrated into the broader Recorded Future intelligence platform. The standalone API remains available and is widely used by security researchers, penetration testers, and threat intelligence analysts for passive DNS reconnaissance.
What MAGO Does
MAGO uses DNS as one component of a broader domain intelligence workflow. Starting from a domain, MAGO chains DNS enumeration with subdomain discovery, WHOIS analysis, certificate transparency searches, HTTP header auditing, technology fingerprinting, and threat intelligence lookups. The automated spell chaining means you get a complete intelligence picture without manually querying multiple tools.
MAGO's DNS analysis covers current records comprehensively but does not maintain its own historical DNS database. Instead, it focuses on turning current DNS data into actionable intelligence by correlating it with other data sources and providing security-focused assessments.
Feature Comparison
| Feature | MAGO | SecurityTrails |
|---|---|---|
| Primary focus | Full domain intelligence | DNS history and records |
| Historical DNS | Per-scan snapshots | Trillions of historical records |
| Current DNS records | Full enumeration | Full enumeration |
| Subdomain discovery | Multi-source (CT, brute, passive) | Subdomain enumeration |
| WHOIS data | Current + correlation | Current + historical |
| Associated domains | Via WHOIS/cert correlation | IP/NS/MX matching |
| Header auditing | Yes (OWASP grading) | No |
| Technology detection | Yes | No |
| Threat intelligence | OTX, ThreatFox, URLhaus | Recorded Future integration |
| Automated chaining | Yes (spell pipelines) | No (single queries) |
| Report generation | Yes (HTML/PDF) | API/export only |
| API availability | REST API | REST API |
Pricing
| Plan | MAGO | SecurityTrails |
|---|---|---|
| Free tier | 5 scans/month | 50 API queries/month |
| Individual | $49/mo | $100/mo (API Basic) |
| Professional | $149/mo | $250/mo (API Pro) |
| Enterprise | Custom | Custom (Recorded Future) |
Pros and Cons
SecurityTrails Pros
- Largest historical DNS database available (trillions of records)
- DNS record history going back to 2008
- Associated Domains feature for infrastructure mapping
- Now backed by Recorded Future for broader threat intelligence
- Well-established API with extensive documentation
SecurityTrails Cons
- Narrow focus -- DNS and WHOIS only, no header or technology analysis
- No automated reconnaissance chaining
- Free tier is minimal (50 queries/month)
- Full platform requires Recorded Future enterprise subscription
- No security scoring or remediation guidance
MAGO Pros
- Broader intelligence scope beyond just DNS records
- Automated spell chaining combines multiple OSINT sources
- Actionable reports with security scoring and remediation
- Header auditing and technology detection included
- More accessible pricing for small teams
MAGO Cons
- No historical DNS database -- current records only
- Cannot match SecurityTrails depth for DNS archaeology
- Newer platform without decade-plus data archive
- Less integration with enterprise threat intelligence platforms
The Verdict
SecurityTrails is unmatched for DNS history and passive DNS research. If you need to know what a domain's A record pointed to in 2012 or find every domain that ever shared an IP with your target, SecurityTrails is the tool. MAGO is the better choice when you need a complete current-state intelligence picture that goes beyond DNS into headers, technology, certificates, and threat indicators. For thorough domain investigations, using SecurityTrails for historical context and MAGO for current attack surface intelligence gives you the fullest picture.
See Your Domain Through MAGO
Run a free domain intelligence scan and see how MAGO compares to SecurityTrails.