HackBlue

Tools · Ethical OSINT and privacy self-defense · 05 / 17

Mapping your domain footprint with dig, WHOIS, and RDAP

Read your domain’s public DNS records, registration data through RDAP, and mail and verification records, and identify stale or overly revealing entries.

9 min read · practice only with authorization

Records worth reading

NS shows who hosts your DNS. MX shows mail servers. TXT records hold SPF, DMARC, and domain verification tokens that reveal which SaaS providers you use. CNAMEs point to cloud services. A and AAAA records reveal IP ranges and hosting providers. Zone transfers (AXFR) should be refused by your name servers to outsiders.

Snippet
dig +short NS example.org
dig +short MX example.org
dig +short TXT example.org
dig +short TXT _dmarc.example.org
dig +short CNAME www.example.org
dig AXFR example.org @$(dig +short NS example.org | head -1)   # should fail

Registration data

RDAP is the modern, structured replacement for WHOIS. Many registrars redact personal data, but registration and expiry dates, registrar, and name servers remain visible. Expiring domains are a real risk: if a domain lapses, someone else can register it and receive your email.

Snippet
curl -s https://rdap.org/domain/example.org | jq '{registrar: .entities[]? | select(.roles[]? == "registrar") | .vcardArray[1][]? | select(.[0]=="fn") | .[3], events: [.events[] | {(.eventAction): .eventDate}]}'
whois example.org | grep -iE 'registrar:|expir|name server'

Lab: footprint table

For your own domain, build a table of every DNS record type above and what it reveals. Highlight TXT verification records for services you no longer use, CNAMEs pointing at deprovisioned cloud resources (a subdomain takeover risk), and the registration expiry date. Remove stale records and set auto-renew.

Dangling records

A CNAME to a cloud resource that was deleted, such as a storage bucket website or app service, can sometimes be claimed by someone else who then serves content on your subdomain. Deleting the DNS record when deprovisioning the resource prevents this. Tools and cloud provider guidance describe which services are affected.

Diagram

What DNS reveals

Public by design; review what you publish.

  • NS

    DNS provider.

  • MX

    Mail provider.

  • TXT

    SPF, DMARC, and SaaS verification tokens.

  • CNAME

    Cloud and SaaS services behind subdomains.

  • RDAP

    Registrar, creation and expiry dates.

Check yourself

1. Which record type often reveals which SaaS providers an organization uses?

2. What is the structured successor to WHOIS?

3. Why are CNAMEs to deleted cloud resources dangerous?