Public Records: DNS, WHOIS, and Your Domain
Read public registration and name records for a domain you control or example.com.
Visual · dns_whois_records
WHOIS and DNS are public record desks for a name. Query example.com or a domain YOU own. Do not AXFR random zones.
WHOIS and DNS are public desks. You may read example.com. You may not steal a stranger’s zone.
Lesson 2 said a probe needs writing. This lesson uses the public-record exception that Module 2 promised: name systems exist so anyone can ask “where is example.com” and “who registered this name.” nslookup or dig of example.com, and whois example.com, are how operators and students read those desks. They are not a zone-transfer (AXFR) attack on a company you do not own. They are not a reason to walk every name in a stranger’s zone. They are not Shodan. Cyberlium allows example.com (IETF example) or a domain THE USER OWNS. That is the list. Topic 3 already introduced DNS as the phone book of the internet. Here you use it as a footprint source: A (address), NS (who answers for the zone), MX (mail). WHOIS shows registrar and sometimes contacts — often redacted for privacy, which is a defender win, not a puzzle to bypass. This is original Cyberlium teaching of the footprinting domain, not official Ethical Hacking courseware and not an exam dump. Next is the lab: copy those facts into $HOME/cyberlium-lab/Ethical Hacking-footprint.txt and chmod 600. This lesson is literacy: run the lookups, know what the records mean, refuse AXFR-on-random.
1. DNS records you will actually read: A, NS, MX — not a steal-the-zone kit
A record: the IPv4 address published for a hostname (example.com often has well-known documentation addresses). NS record: the name servers that are authoritative for the zone — the desks that answer. MX record: hosts willing to receive mail for the domain. You ask a resolver; the resolver returns what is published. That is a lookup, not a hack. You do not need to “brute subdomain lists” against someone else’s zone for this course. You do not need to request AXFR (a full zone copy) from a name server you do not administer. Many name servers refuse AXFR from the internet on purpose. Asking a random company’s NS for AXFR is an attack pattern, not a Cyberlium lab, even if a blog titled it “Ethical Hacking footprinting.”
nslookup example.com (Windows and others) or dig example.com (bind-utils / Git Bash / WSL / macOS) is enough. Read the answer section. Write the A/NS/MX lines into notes. If MX is missing, write “none published” — that is a fact, not a failure. If your network blocks DNS tools, use a browser-based lookup only for example.com or YOUR domain, still not for a bank. Do not switch to a “more interesting” name because example.com is documented. Documented is the point.
Command guide
DNS A/NS/MX — WHAT/WHY (example.com, not a zone steal)
═══ INSTALL ═══
Linux (Debian/Ubuntu): Built-in
macOS: Built-in
Windows: Built-in
═══ COMMANDS ═══
Command — copy this
nslookup -type=A example.com || getent hosts example.com
Command — copy this
nslookup -type=NS example.com; echo '---'; nslookup -type=MX example.com
2. WHOIS: registrar public record, often privacy-redacted — not a people hunt
WHOIS (and newer RDAP) is the registration record: registrar name, dates, name servers, sometimes abuse contacts. Privacy services replace a person’s home address with a proxy — good. You will not try to unmask a registrant. You will not use WHOIS to build a stalker file. On example.com, you may see IANA/example documentation text rather than a hobbyist’s phone number; write what the tool printed, not what you wish it printed. On a domain YOU own, WHOIS is a mirror of what you (or your registrar) published. Read it so you know what the world can already see about YOUR name.
whois example.com works on many Unix-like systems. On Windows, install a whois client you trust, use WSL, or use your registrar’s web WHOIS for YOUR domain / the example.com record. Cap what you paste into notes: registrar, dates, NS, “contacts redacted or n/a.” Do not paste other people’s personal emails if a record still shows them — skip or redact. chmod 600. WHOIS rate limits exist; one lookup of one allowed name is the lesson, not a loop across a TLD.
Command guide
WHOIS public record — WHAT/WHY (not a people hunt)
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install whois
macOS:
Command — copy this
brew install whois
Windows: Use https://lookup.icann.org or install via WSL
═══ COMMANDS ═══
Command — copy this
whois example.com | head -n 40
Command — copy this
cat >> "$NOTES" << 'EOF' whois_means: registrar public record, often privacy-redacted not_whois: harvesting personal emails of strangers as homework EOF
3. example.com vs a domain you control — same commands, same refusal list
If you own a domain, you may run the same nslookup/dig/whois against THAT name to see your own public face. That is defender homework: what did I publish. If you do not own one, example.com is complete. Do not pick a celebrity domain, a school, or a local shop “because they have MX.” Those names are not in Module 1 RoE. DNS being public does not mean every name is your lab. The internet’s phone book is public; photocopying every listing into a targeting list is still a choice this course will not assign.
IPv6 AAAA, TXT (SPF/DMARC as literacy on YOUR domain), and CNAME are optional extras on a name you own. They are not a reason to enumerate a stranger’s cloud. CAA records tell CAs what may issue certificates — useful on YOUR domain, not a hunt. Stay on the A/NS/MX/WHOIS core so the lab file stays gradeable and ethical.
Command guide
example.com vs YOUR domain — WHAT/WHY same refusal list
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install whois
macOS:
Command — copy this
brew install whois
Windows: Use https://lookup.icann.org or install via WSL
═══ COMMANDS ═══
Command — copy this
cat >> "$NOTES" << 'EOF' queried: example.com (or MY domain — fill) refuse: AXFR against random, Shodan of strangers, neighbor site as lab EOF
4. Zone transfer is not this lesson — refuse AXFR against names you do not run
A zone transfer is a bulk copy of DNS data, used between name servers you administer. Aimed at a random domain, it is an attempt to pull a map you were not given. This course will not give you dig axfr commands pointed at third parties. If your own lab DNS allows AXFR from localhost because you configured it, that is YOUR server — still not a template for the internet. If a tutorial says “find an open AXFR as Ethical Hacking practice,” that tutorial is not Cyberlium. Write in notes: “AXFR on random domains: out of scope.”
Same refusal for DNS brute-force wordlists against someone else’s zone, for “zone walking” tricks, and for using WHOIS history sites to unmask people. Public record literacy is A/NS/MX plus registrar fields on an allowed name. Stop there. Lesson 4 will collate what you already have, not add a stealth DNS kit.
5. Wrong vs right: AXFR-on-random vs nslookup/whois of example.com
Worked failure — same dig binary, opposite ethics. Right treats DNS/WHOIS as a desk for an allowed name, not a loot crate.
- Wrong: dig axfr against a company you do not own. Brute subdomains of a school. WHOIS-loop a TLD. Unmask privacy-protected registrants. Query a neighbor’s hostname because it “looks public.” Save personal emails world-readable. Call it official Ethical Hacking. It is not, and this course will not.
- Right: nslookup or dig example.com (or YOUR domain): write A/NS/MX. whois example.com (or YOUR domain): write registrar/dates/NS, redact personal contacts. Notes in $HOME/cyberlium-lab, chmod 600. No AXFR on strangers. No dorks. Next: Lab — collate into Ethical Hacking-footprint.txt.
6. Hands-on: nslookup/dig and whois of example.com (or YOUR domain)
Run the lookups. Paste summaries — not a megabyte of raw whois — into dns-whois-notes.txt. If whois is missing, write “whois unavailable; registrar web used / skipped” and still record DNS. Do not change the name to a bank. chmod 600. The helper script only prints the allowed hostname and reminder lines; the OS tools do the queries.
Command guide
dns_whois_public.sh — nslookup/dig + whois of example.com (or YOUR domain)
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install dnsutils sudo apt install whois
macOS:
Command — copy this
brew install bind brew install whois
Windows: Built-in: nslookup (or install BIND for dig) Use https://lookup.icann.org or install via WSL
═══ COMMANDS ═══
Command — copy this
cd "$HOME/cyberlium-lab"
Command — copy this
DOMAIN="example.com"
Command — copy this
nslookup "$DOMAIN" dig "$DOMAIN" A +noall +answer dig "$DOMAIN" NS +noall +answer dig "$DOMAIN" MX +noall +answer
Command — copy this
whois "$DOMAIN" | head -n 80
Command — copy this
{Mission: dns-whois-notes.txt in cyberlium-lab (mode 600)
1) Run nslookup or dig against example.com (or a domain YOU own). Record A, NS, MX (or “none published”). 2) Run whois (or registrar web WHOIS) for that same allowed name. Record registrar/dates/NS; redact personal contacts. 3) Write “AXFR on random domains: out of scope.” chmod 600 $HOME/cyberlium-lab/dns-whois-notes.txt. Do not retarget a school or shop.
Stuck? Ask Cyberlium AI Mentor
If “DNS is public so any zone is my lab” still feels true, ask for a hint — not an AXFR target. Try: "Hint only: what do A/NS/MX mean for example.com, why whois privacy redaction is not a puzzle, and why zone transfer against a domain I do not run is out of this lesson?" You still fill the notes. No stranger zones. No people hunt.
You can now read the public DNS and WHOIS desks for example.com or a name you control, name A/NS/MX in plain language, and refuse AXFR and registrant unmasking. That is footprinting as literacy, not as theft of a zone. Original Cyberlium, not official Ethical Hacking. Next — Lab — Footprint a Domain You Own — collates these rows (plus Lesson 1 page facts) into $HOME/cyberlium-lab/Ethical Hacking-footprint.txt mode 600.
APPLY: A blog says “Ethical Hacking footprinting = AXFR any NS that answers.” You have nslookup of example.com. Correct move?
APPLY: True or False: Privacy-redacted WHOIS means you should hunt the registrant’s home address, because public records must be complete.
APPLY: Match the record to the meaning, on example.com or a domain you own.
APPLY: curl of http://192.168.0.1/ shows a home router login (TP-Link / Netgear / Huawei / "Router Admin"). Is that DEMO in scope as a hacking target?