OTInstaller
Sign in

Domain investigation playbook

Verified publisher

DNS, subdomains, certificates, history and look-alikes of a domain, passively first

intermediateabout domain11 toolslicence CC-BY-4.0
Contents 3/7
  1. 1 Domain investigation playbook
  2. 2 Scope and legal
  3. 3 DNS records
  4. 4 Subdomains
  5. 5 History
  6. 6 Look-alike domains
  7. 7 Live hosts (active)
Tools (11)

Tools used in this guide

  • dns-records Looks up a domain's A, AAAA, CNAME, MX, NS, TXT, SOA and CAA recordsot install osintverse-community/dns-records
  • crtsh-subdomains Finds a domain's subdomains in Certificate Transparency logs through crt.sh or Cert Spotterot install osintverse-community/crtsh-subdomains
  • subfinder Finds a domain's subdomains passively from dozens of public sourcesot install osintverse-community/subfinder
  • gau Gets every known URL of a domain from the Wayback Machine, Common Crawl, OTX and urlscanot install osintverse-community/gau
  • waybackpy Finds the oldest or newest Wayback Machine capture of a URL, or every archived URL of a siteot install osintverse-community/waybackpy
  • dnstwist Finds registered look-alike domains for phishing, typosquatting and brand impersonationot install osintverse-community/dnstwist
  • httpx Probes a host's web server: status, title, technologies, TLS, CDN and IPot install osintverse-community/httpx
  • tlsx Reads a server's TLS certificate: names it covers, issuer, validity, fingerprints and JARMot install osintverse-community/tlsx
  • tldextract Splits a URL or hostname into subdomain, registered domain and public suffixot install osintverse-community/tldextract
  • checkdmarc Checks a domain's SPF, DMARC, MX, BIMI and DNSSEC records and reports problemsot install osintverse-community/checkdmarc
  • unfurl Breaks a URL into everything it encodes: timestamps, IDs, search terms, tracking and session dataot install osintverse-community/unfurl

Install them all:

ot guide tools osintverse-community/domain-investigation

DNS records

ot run osintverse-community/dns-records --domain example.com --format table
Record What it tells you
A / AAAA Where the website is hosted. Look the IPs up with the IP playbook. A CDN address (Cloudflare, Fastly, Akamai) hides the real server.
NS Who runs the DNS. Registrar defaults, a CDN, or the organisation's own servers.
MX Who handles email: Google, Microsoft, a security gateway, or self-hosted.
TXT SPF (which systems send mail for the domain) and verification tokens for services the organisation uses.
CAA Which certificate authorities may issue for the domain.
SOA The primary name server and, sometimes, a contact address.

For the email side (SPF, DMARC, BIMI) in detail, run osintverse-community/checkdmarc.

To split a messy list of URLs into their registered domains and subdomains:

ot run osintverse-community/tldextract --url "https://forums.news.example.co.uk/thread/1"

Next: subdomains.

Published 20 Oct 2026. Read it in a terminal: ot guide read osintverse-community/domain-investigation; offline: ot guide get osintverse-community/domain-investigation · Source · Markdown

Esc

Try

↑ ↓ to move↵ to open