Lion Cipher Lab
Passive domain recon, part 1: read one domain for phishing tells with dig and whois
- Threat Intel Analyst
- Beginner
- ~30 min
- Free · no account required
Why it matters
A domain name is one of the most common clues a defender is handed — the site a phishing email wanted a colleague to click, the address a suspicious program reached out to, a lookalike of your own company's domain. Before you can judge whether a domain is worth worrying about, you need to read what it publicly says about itself, and almost all of that is a free lookup away. The public DNS records tell you where the domain's mail is meant to go and who is authorised to send email as it; the public registration record tells you who registered it, through which registrar, and — often the single…
What you'll learn
- reading DNS records (A, MX, TXT, NS)
- using dig
- using whois
- reading a domain's registration and age
- understanding SPF and DMARC
- spotting phishing-domain tells
Steps in this lab
- The plan, and the one rule that carries over
- Resolve the basics: A and NS records with dig
- Where does its mail go? MX records
- Read the registration and — above all — the age with whois
- TXT records and SPF: who is allowed to send mail as this domain
- DMARC: the policy that ties the email records together
- Put it together: reading a domain for phishing tells
- Why two commands are worth keeping in your hands