Domain Reconnaissance

Overview

Comprehensive domain intelligence gathering using DataPulse tools. This workflow reveals infrastructure, hosting, mail configuration, security posture, and historical changes.

Full Reconnaissance Workflow

Phase 1: DNS Infrastructure

# DNS lookup — returns A, AAAA, MX, NS, TXT, SOA, CNAME, CAA, DNSKEY, DS in one call
datapulse_live_dns(domain="example.com")

What to look for:

• IP ranges → hosting provider identification
• NS records → DNS provider (Cloudflare, AWS Route53, etc.)
• CNAME chains → CDN usage (Cloudflare, Fastly, Akamai)
• MX records → mail provider (Google, Microsoft, Proofpoint, Mimecast)
• TXT records → SPF includes, authorized senders
• CAA → which CAs can issue certs (Let’s Encrypt, DigiCert, etc.)
• DNSKEY → zone signing status

Phase 2: DNSSEC Validation (optional)

The Phase 1 summary includes dnssec_signed: true when the zone is DNSSEC-validated.

For deeper chain-of-trust inspection, use full=true to see per-query flags and RRSIG records, and query DNSKEY/DS (also with full=true — the summary strips DNSSEC record types):

datapulse_live_dns(domain="example.com", full=true)
datapulse_live_dns(domain="example.com", record_type="DNSKEY", full=true)
datapulse_live_dns(domain="example.com", record_type="DS", full=true)

What to look for:

• dnssec_signed: true in summary → DNSSEC validation working
• flags.ad: true in full output → per-query authenticated data
• RRSIG records in full output → signature details (algorithm, expiry, key_tag)
• DNSKEY flags 257 → Key Signing Key (KSK)
• DS record in parent zone → delegation signer chain intact

Phase 3: Registration Intelligence

datapulse_live_rdap(query="example.com")

What to look for:

• Creation date → domain age. Older means the string has existed longer, not that the apparent owner registered it or still holds it; read it alongside datapulse_dns_dphistory, since a long registration with a churning operational history is a different object than a long registration on stable infrastructure
• Expiry date → renewal patterns
• Registrar → MarkMonitor (enterprise), GoDaddy (SMB), etc.
• Status codes → lock status, any holds
• Nameserver consistency with NS records

Phase 4: Historical Analysis

datapulse_dns_dphistory(domain="example.com")

What to look for:

• Infrastructure changes over time
• Hosting migrations (AWS → Cloudflare, etc.)
• ASN changes → ownership or provider shifts
• NS changes → DNS provider migrations
• Recent changes → potential incidents or migrations in progress

Phase 5: Infrastructure Similarity

datapulse_dns_dptechsim(domain="example.com", similarity=0.90)

What to look for:

• Related domains with similar infrastructure (same operator, same hosting pattern)
• Shared nameserver configurations
• Common ASN patterns across domains
• Registrar/registration date clustering (may indicate same owner)

Pivoting from results:

# For suspicious matches, drill deeper
datapulse_dns_dphistory(domain="similar-domain.com")
datapulse_live_rdap(query="similar-domain.com")

Quick Recon Checklist

Identifying Providers

Hosting/CDN (from A/CNAME)

A bare address tells you the holder only through its RIR record: /8 prefixes such as 13., 20., 35., 40. and 52. are split among many organisations, so never map a first octet to a cloud provider. Run datapulse_live_rdap(query="<ip>") and read organization and network_name from the RIR instead.

DNS (from NS)

Mail (from MX)

Matching the MX suffix identifies the platform, not the account holder. Anyone may point an MX at any host; hosted platforms derive the inbound hostname from the tenant’s own domain, so an MX naming another organisation’s tenant is a copied record. See datapulse_help(topic="email_security") and datapulse_help(topic="brand_adjacent"). | *.pphosted.com | Proofpoint | | *.mimecast.com | Mimecast |

Subdomain Discovery Hints

Try common subdomains:

datapulse_live_dns(domain="www.example.com")
datapulse_live_dns(domain="mail.example.com")
datapulse_live_dns(domain="api.example.com")
datapulse_live_dns(domain="app.example.com")
datapulse_live_dns(domain="dev.example.com")
datapulse_live_dns(domain="staging.example.com")
datapulse_live_dns(domain="admin.example.com")
datapulse_live_dns(domain="vpn.example.com")
datapulse_live_dns(domain="remote.example.com")

Check for wildcard:

datapulse_live_dns(domain="randomstring12345.example.com")

If this resolves, wildcard DNS is configured.

SRV Record Discovery

Use record_type="SRV" to discover services:

datapulse_live_dns(domain="_sip._tcp.example.com", record_type="SRV")
datapulse_live_dns(domain="_sipfederationtls._tcp.example.com", record_type="SRV")   # Microsoft Lync/Teams
datapulse_live_dns(domain="_xmpp-server._tcp.example.com", record_type="SRV")        # Jabber/XMPP
datapulse_live_dns(domain="_ldap._tcp.example.com", record_type="SRV")               # Active Directory