Overview
Domain records are a rich, public source of intelligence about an organization's online presence. This lesson introduces domain-based OSINT.
Learning objectives
- Explain what domain records reveal.
- Identify types of domain information.
- Connect domain intelligence to mapping online presence.
Core concept
Domain records are the public data associated with an organization's domains — registration information, DNS records, nameservers, associated subdomains, and historical data. Together they reveal an organization's online infrastructure footprint: which domains and subdomains it uses, where they point, its mail and name-server setup, and clues to its hosting and services. Domain intelligence is a core OSINT area for understanding an organization's public technical presence — the same public data used in the networking DNS and passive-recon lessons, analyzed here for intelligence.
How it works
The practitioner gathers an organization's public domain data — registration details (WHOIS, next lesson), DNS records (addresses, mail, name servers), subdomains, and historical clues — and analyzes it to build a picture of the organization's infrastructure footprint: its domains/subdomains, where they resolve, its hosting and mail providers, and how its online presence is structured. This is public information (the domain system is public), gathered passively, and used to map the organization's technical presence for legitimate purposes (security assessment, threat intelligence, due diligence). As always, findings are verified and treated with appropriate source-quality judgment (some data may be outdated or privacy-protected).
Practical example
Investigating an organization's public footprint, the practitioner gathers its domain records: registration information, DNS records showing where its domains point and its mail/name-server setup, and its subdomains. Analyzing these, they build a picture of the organization's infrastructure — its domains and subdomains, hosting, and mail providers. All from public domain data, gathered passively. This footprint informs, for instance, a security assessment of the organization's public attack surface. Findings are verified and any privacy-protected/outdated data noted.
Cybersecurity relevance
Domain intelligence is a core OSINT area for mapping an organization's public infrastructure footprint — valuable for security assessment (attack surface), threat intelligence, and due diligence — connecting to the networking DNS and ethical-hacking passive-recon lessons. It uses public domain-system data, gathered passively and analyzed for intelligence. For defenders, it highlights what their domain data publicly reveals (footprint exposure). It is conducted ethically (public data, legitimate purpose) with verification and source-quality judgment (some domain data is privacy-protected or outdated). This module details the components: WHOIS/registration, DNS, nameservers, and historical clues.
Common mistakes
- Overlooking domain records as an intelligence source for mapping online presence.
- Treating domain data as fully current/accurate without verification (some is outdated/protected).
- Forgetting it's public data used ethically for legitimate purposes.
Key takeaways
- Domain records (registration, DNS, nameservers, subdomains, historical data) publicly reveal an organization's online infrastructure footprint.
- Analyzing them builds a picture of an organization's domains/subdomains, hosting, and mail setup — a core OSINT area for security, threat intel, and due diligence.
- It uses public domain-system data, gathered passively and verified; it highlights footprint exposure for defenders, and the module details WHOIS, DNS, nameservers, and historical clues.
Check your understanding
- What can domain records reveal about an organization's online presence?
- Why is domain intelligence considered public-source and gathered passively?