WHOIS & DNS Recon

Registration and DNS records reveal ownership, infrastructure, and mail security posture — all passive.

WHOIS / RDAP

whois example.com          # registrar, dates, nameservers, registrant

RDAP is the structured successor — query https://rdap.org/domain/example.com. Registrant details are often GDPR-redacted; the registrar, creation date, and nameservers still pivot well. Historical WHOIS (WhoisXML, SecurityTrails) can show pre-redaction owners and registrant email — feed those to email-osint.

DNS records