Buying a domain that someone else already used is a gamble you can partly de-risk with about five minutes of DNS work. These are the lookups worth running before money changes hands, and what each result actually tells you.
dig NS example.com +short shows the current nameservers. Parking nameservers (sedoparking, bodis, above.com and similar) mean the domain is monetised and probably being sold at a markup. dig +trace example.com walks the delegation from the root and shows you where any inconsistency lives. If the registry says one thing and the nameservers say another, the domain is mid-transfer.
Run dig MX example.com +short and dig TXT example.com +short. Leftover MX records pointing at Google Workspace or Microsoft 365, plus SPF and DKIM entries, tell you the domain ran real email for a real business. That is often good news for reputation, but it also means old inboxes may still be receiving password resets addressed to former staff. Plan to take over or explicitly break those flows on day one.
A domain that was used for spam carries that history. Query the Spamhaus domain blocklist directly: dig example.com.dbl.spamhaus.org +short — any 127.0.1.x answer is a listing, and the last octet identifies the category. An empty answer is what you want. Also check the IP the A record points to against an IP blocklist, since shared hosting neighbours can poison it independently of the domain itself.
dig DNSKEY example.com +short tells you whether DNSSEC is signed. A signed domain that you move to a registrar without matching DS records goes dark — resolvers will refuse the answers entirely, and it is one of the most common self-inflicted outages after a transfer. dig CAA example.com +short shows which certificate authorities are permitted to issue; an inherited CAA record that excludes Let's Encrypt will silently fail your first certificate request.
Run dig A example.com and read the TTL column. If the current records carry a 86400-second TTL, plan your cutover a full day ahead, or ask the seller to lower TTLs to 300 seconds before the handover. This is free, takes one email, and turns a 24-hour propagation window into five minutes.
Pair the DNS work with an RDAP lookup: curl -s https://rdap.org/domain/example.com. The events array gives creation and expiry dates, and the status array tells you whether the domain is locked, in a redemption period, or pending delete. A domain created fifteen years ago with continuous renewals is a different asset from one registered eight months ago and already parked.
None of this reveals a trademark conflict, a manual search penalty, or a toxic backlink profile. DNS answers the question "is this domain technically clean and cheap to migrate". The brand and search questions still need a trademark search and an honest look at the site's archived history before you pay.