Domains and DNS

How to investigate a domain: WHOIS/RDAP, DNS records, subdomains and certificate transparency.

Registration

RDAP and WHOIS show registrar, creation and expiry dates. Personal data is usually redacted, but a very recent registration is a common phishing signal.

DNS records

A and AAAA point to servers, MX shows the mail provider, TXT holds SPF and verification tokens that reveal services in use. NS shows who runs the DNS.

Subdomains

Certificate transparency logs list every certificate issued for a domain, so they expose subdomains without touching the target. Compare them with what you expect to see.

NextIP addresses and networks

Use public sources only, for lawful purposes. Verify every finding independently.