Many folks like to outsource DNS hosting for smaller sites, which doesn't afford logging capabilities. Out of curiosity I chose to self-host DNS on one of my domains. I noticed many queries for MX records, and naturally assumed it was spammers looking for domains to send mail to. Looking at it again, I could see where maybe they were ultimately looking for which domains lack SPF and DKIM, perhaps checking MX first.