Public Records: DNS, WHOIS, and Your Domain

A record: the IPv4 address published for a hostname (example.com often has well-known documentation addresses). NS record: the name servers that are authoritative for the zone — the desks that answer. MX record: hosts willing to receive mail for the domain. You ask a resolver; the resolver returns what is published. That is a lookup, not a hack. You do not need to “brute subdomain lists” against someone else’s zone for this course. You do not need to request AXFR (a full zone copy) from a name server you do not administer. Many name servers refuse AXFR from the internet on purpose. Asking a random company’s NS for AXFR is an attack pattern, not a Cyberlium lab, even if a blog titled it “CEH footprinting.”

nslookup example.com (Windows and others) or dig example.com (bind-utils / Git Bash / WSL / macOS) is enough. Read the answer section. Write the A/NS/MX lines into notes. If MX is missing, write “none published” — that is a fact, not a failure. If your network blocks DNS tools, use a browser-based lookup only for example.com or YOUR domain, still not for a bank. Do not switch to a “more interesting” name because example.com is documented. Documented is the point.

nslookup -type=A example.com || getent hosts example.com

nslookup -type=NS example.com; echo '---'; nslookup -type=MX example.com

WHOIS (and newer RDAP) is the registration record: registrar name, dates, name servers, sometimes abuse contacts. Privacy services replace a person’s home address with a proxy — good. You will not try to unmask a registrant. You will not use WHOIS to build a stalker file. On example.com, you may see IANA/example documentation text rather than a hobbyist’s phone number; write what the tool printed, not what you wish it printed. On a domain YOU own, WHOIS is a mirror of what you (or your registrar) published. Read it so you know what the world can already see about YOUR name.

whois example.com works on many Unix-like systems. On Windows, install a whois client you trust, use WSL, or use your registrar’s web WHOIS for YOUR domain / the example.com record. Cap what you paste into notes: registrar, dates, NS, “contacts redacted or n/a.” Do not paste other people’s personal emails if a record still shows them — skip or redact. chmod 600. WHOIS rate limits exist; one lookup of one allowed name is the lesson, not a loop across a TLD.

sudo apt install whois

brew install whois

whois example.com | head -n 40

cat >> "$NOTES" << 'EOF'
whois_means: registrar public record, often privacy-redacted
not_whois: harvesting personal emails of strangers as homework
EOF

If you own a domain, you may run the same nslookup/dig/whois against THAT name to see your own public face. That is defender homework: what did I publish. If you do not own one, example.com is complete. Do not pick a celebrity domain, a school, or a local shop “because they have MX.” Those names are not in Module 1 RoE. DNS being public does not mean every name is your lab. The internet’s phone book is public; photocopying every listing into a targeting list is still a choice this course will not assign.

IPv6 AAAA, TXT (SPF/DMARC as literacy on YOUR domain), and CNAME are optional extras on a name you own. They are not a reason to enumerate a stranger’s cloud. CAA records tell CAs what may issue certificates — useful on YOUR domain, not a hunt. Stay on the A/NS/MX/WHOIS core so the lab file stays gradeable and ethical.

sudo apt install whois

brew install whois

cat >> "$NOTES" << 'EOF'
queried: example.com (or MY domain — fill)
refuse: AXFR against random, Shodan of strangers, neighbor site as lab
EOF

A zone transfer is a bulk copy of DNS data, used between name servers you administer. Aimed at a random domain, it is an attempt to pull a map you were not given. This course will not give you dig axfr commands pointed at third parties. If your own lab DNS allows AXFR from localhost because you configured it, that is YOUR server — still not a template for the internet. If a tutorial says “find an open AXFR as CEH practice,” that tutorial is not Cyberlium. Write in notes: “AXFR on random domains: out of scope.”

Same refusal for DNS brute-force wordlists against someone else’s zone, for “zone walking” tricks, and for using WHOIS history sites to unmask people. Public record literacy is A/NS/MX plus registrar fields on an allowed name. Stop there. Lesson 4 will collate what you already have, not add a stealth DNS kit.

Run the lookups. Paste summaries — not a megabyte of raw whois — into dns-whois-notes.txt. If whois is missing, write “whois unavailable; registrar web used / skipped” and still record DNS. Do not change the name to a bank. chmod 600. The helper script only prints the allowed hostname and reminder lines; the OS tools do the queries.

sudo apt install dnsutils
sudo apt install whois

brew install bind
brew install whois

cd "$HOME/cyberlium-lab"

DOMAIN="example.com"

nslookup "$DOMAIN"
dig "$DOMAIN" A +noall +answer
dig "$DOMAIN" NS +noall +answer
dig "$DOMAIN" MX +noall +answer

whois "$DOMAIN" | head -n 80

{

You can now read the public DNS and WHOIS desks for example.com or a name you control, name A/NS/MX in plain language, and refuse AXFR and registrant unmasking. That is footprinting as literacy, not as theft of a zone. Original Cyberlium, not official CEH. Next — Lab — Footprint a Domain You Own — collates these rows (plus Lesson 1 page facts) into $HOME/cyberlium-lab/ceh-footprint.txt mode 600.