OTInstaller
Sign in

Domain investigation playbook

Verified publisher

DNS, subdomains, certificates, history and look-alikes of a domain, passively first

intermediateabout domain11 toolslicence CC-BY-4.0
Contents 2/7
  1. 1 Domain investigation playbook
  2. 2 Scope and legal
  3. 3 DNS records
  4. 4 Subdomains
  5. 5 History
  6. 6 Look-alike domains
  7. 7 Live hosts (active)
Tools (11)

Tools used in this guide

  • dns-records Looks up a domain's A, AAAA, CNAME, MX, NS, TXT, SOA and CAA recordsot install osintverse-community/dns-records
  • crtsh-subdomains Finds a domain's subdomains in Certificate Transparency logs through crt.sh or Cert Spotterot install osintverse-community/crtsh-subdomains
  • subfinder Finds a domain's subdomains passively from dozens of public sourcesot install osintverse-community/subfinder
  • gau Gets every known URL of a domain from the Wayback Machine, Common Crawl, OTX and urlscanot install osintverse-community/gau
  • waybackpy Finds the oldest or newest Wayback Machine capture of a URL, or every archived URL of a siteot install osintverse-community/waybackpy
  • dnstwist Finds registered look-alike domains for phishing, typosquatting and brand impersonationot install osintverse-community/dnstwist
  • httpx Probes a host's web server: status, title, technologies, TLS, CDN and IPot install osintverse-community/httpx
  • tlsx Reads a server's TLS certificate: names it covers, issuer, validity, fingerprints and JARMot install osintverse-community/tlsx
  • tldextract Splits a URL or hostname into subdomain, registered domain and public suffixot install osintverse-community/tldextract
  • checkdmarc Checks a domain's SPF, DMARC, MX, BIMI and DNSSEC records and reports problemsot install osintverse-community/checkdmarc
  • unfurl Breaks a URL into everything it encodes: timestamps, IDs, search terms, tracking and session dataot install osintverse-community/unfurl

Install them all:

ot guide tools osintverse-community/domain-investigation
  • Passive vs active. DNS lookups, certificate logs and archives never touch the target's servers, and are fine for almost any purpose. Probing live hosts sends requests to the target and needs a reason you can defend; port scanning and vulnerability testing need written permission from the owner.
  • Stay in scope. Subdomain lists often include third-party services (status., mail., a CDN). Being listed under a domain does not make a server part of your authorised scope.
  • Personal data. Registration records and archived pages can contain names, addresses and phone numbers. Collect them only if your question needs them.

Tip

Note the date of every lookup. DNS answers and certificates change; your notes should say what was true when.

Published 20 Oct 2026. Read it in a terminal: ot guide read osintverse-community/domain-investigation; offline: ot guide get osintverse-community/domain-investigation · Source · Markdown

Esc

Try

↑ ↓ to move↵ to open