> For the complete documentation index, see [llms.txt](https://riteshs4hu.gitbook.io/infosec-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://riteshs4hu.gitbook.io/infosec-notes/reconnaissance/passive-reconnaissance-techniques/dns-footprinting.md).

# DNS Footprinting

DNS (Domain Name System) reconnaissance is a crucial part of passive reconnaissance, which gathers domain-related information without directly interacting with the target’s infrastructure. This helps identify subdomains, IP addresses, DNS records, and historical data useful for further enumeration or exploitation.

### **WHOIS Lookup**

WHOIS lookup provides details about domain ownership, registration information, and name servers.

**WHOIS**

* Retrieves domain owner details, registrar information, and expiry dates.
* Useful for identifying associated domains and administrative contacts.
* **Command:**

  ```
  whois example.com
  ```
* **Online Services:**
  * [Whois Lookup](https://who.is/)
  * [ICANN Whois](https://lookup.icann.org/)
  * [DomainTools](https://whois.domaintools.com/)

**Reverse WHOIS**

* Identifies domains owned by a specific person, email, or organization.
* **Online Services:**
  * [Domainiq](https://domainiq.com/)
  * [WhoXY](https://www.whoxy.com/reverse-whois/)
  * [ViewDNS](https://viewdns.info/reversewhois/)
  * [ICANN](https://lookup.icann.org/en)

**WHOIS History**

* Provides past registration details, which can help track domain ownership changes.
* **Tools:**
  * [Whois History](https://whoisrequest.com/history/)

***

#### **Host/Domain Name to IP Address**

* Resolves a domain name to an IP address and vice versa.
* **Command:**

  ```
  nslookup example.com
  ```

  or

  ```
  dig example.com
  ```
* **Online Tools:**
  * [NsLookup](https://www.nslookup.io/website-to-ip-lookup/)
  * [Site24x7](https://www.site24x7.com/tools/find-ip-address-of-web-site.html)

***

#### **IP History**

* Identifies historical IP addresses associated with a domain.
* Useful for discovering old infrastructure.
* **Tools:**
  * [Viewdns](https://viewdns.info/iphistory/)
  * [IPhistory](https://www.iphistory.ch/en/)

***

#### **DNS Record Lookup**

* Retrieves DNS records such as A, CNAME, MX, TXT, and NS records.
* **Command:**

  ```
  dig example.com ANY
  ```

  or

  ```
  host -t A example.com
  ```
* **Online Tools:**
  * [MXToolbox](https://mxtoolbox.com/)
  * [DNSDumpster](https://dnsdumpster.com/)

***

#### **Reverse IP Domain Lookup**

* Finds all domains hosted on the same server.
* Helps in identifying shared hosting environments.
* **Tools:** [ViewDNS.info Reverse IP Lookup](https://viewdns.info/reverseip/)

***

#### **Reverse Mail Server Lookup**

* Finds domains that use the same mail server.
* **Tools:** [MXToolbox](https://mxtoolbox.com/)

***

#### **Reverse Name Server Lookup**

* Identifies domains hosted on the same name server.
* Useful for mapping an organization’s infrastructure.
* **Tools:** [ViewDNS.info](https://viewdns.info/reversens/?)

***

#### **Restrict Certificate Transparency Logs**

* Certificate Transparency logs reveal subdomains used by an organization.
* Attackers can use CT logs to identify staging or internal domains.
* **Search CT Logs:** [crt.sh](https://crt.sh/)
* **Defensive Measure:** Use **CAA Records** to restrict unauthorized certificate issuance.

***

#### **DNSSEC Test**

* Checks whether a domain has **DNSSEC (Domain Name System Security Extensions)** enabled.
* **Why?** DNSSEC prevents DNS spoofing by ensuring integrity of DNS responses.
* **Online Tools:**
  * [DNSViz](https://dnsviz.net/)
  * [Verisign DNSSEC Debugger](https://dnssec-debugger.verisignlabs.com/)

***

Some common websites that provide various types of DNS-related information:

* [DomainIQ](https://domainiq.com/)
* [Robtex](https://www.robtex.com/)
* [ViewDNS.info](https://viewdns.info/)
* [CentralOps Domain Dossier](https://centralops.net/co/DomainDossier.aspx)
* [DNSChecker](https://dnschecker.org/)
* [DNSSpy](https://dnsspy.io/)
* [Whoxy](https://www.whoxy.com/)
* [Check-Host](https://check-host.net/)
* [BGP HE](https://bgp.he.net/)
* [DNSlytics](https://dnslytics.com/)