Digging DNS

This site is an ever growing and updated collection of everything I have ever learned or wish someone had told me about domain names. You will find a bit of everything here, including:

Basics of domain names
How the industry works
Investigating domain names
Combating DNS abuse
Rants on why things are the way they are

Updated as I have free time/think of things/people make suggestions.

Basics

A Guide to DNS and Its Common Record Types

Understand how the internet finds websites and the essential DNS records like A, MX, CNAME, and TXT that make it all work.

Updated: 2025-07-03

Anatomy of a Domain

A good place to start to understand the different parts of a domain name.

Updated: 2025-05-22

A Glossary of Common Domain Name & Internet Terminology

Defining key terms related to domain names, DNS, and internet infrastructure to help you build your understanding.

Updated: 2025-06-04

Domains and IP Addresses: A Guide to Their Relationship

It's not always one domain, one IP address. Learn how IPv4 scarcity, web servers, and services like Cloudflare enable many websites to live at the same digital address.

Updated: 2025-07-07

ICANN, IANA, Registries & Registrars

The four major entities behind domain names.

Updated: 2025-05-27

An Introduction to WHOIS

WHOIS - the protocol that used to be a goldmine of personal data.

Updated: 2025-05-22

Understanding Effective TLDs (eTLDs) and the Public Suffix List

Master the nuance of the eTLD, and the internet becomes much easier to understand.

Updated: 2025-06-17

Deep

Choosing Your DNS Resolver

Should you use your ISP's DNS, switch to a public resolver, or run your own?

Updated: 2025-07-10

The Economics of a Domain Name

Who knew a $9.99 domain had so much financial engineering behind it?

Updated: 2025-06-10

How to Improve Your DNS Abuse Reports: An MCDA-Inspired Approach

Simple steps and a scoring framework to increase your chances of having an abusive domain taken offline. But, no promises.

Updated: 2025-06-05

The Wild World of ccTLDs

A dive into the chaotic and fascinating world of country-code TLDs, where sovereignty, economics, and geopolitics create a system far different from .com.

Updated: 2025-08-26

A Thought Exercise in Money Laundering with a Registrar

It's quiet trivial, really.

Updated: 2026-03-24

Who Pays the Bill for Abusive Domains?

When a bad actor uses a stolen credit card to register a domain, who really loses money? A look at the financial fallout of DNS abuse.

Updated: 2025-08-26

The Invisible Victim: Why the System Fails in Cybercrime

When the money is gone and the accounts are breached, victims often find themselves in a support vacuum. Here is why the system fails and how to protect yourself.

Updated: 2026-01-02

Takedowns

The Challenges with Compromised Sites

Why addressing DNS abuse on a compromised site is sometimes more challenging than it should be and how to address it.

Updated: 2026-01-07

Are You Down? A Guide to Determining What Kind of 'Down' a Site Is

A site being 'down' isn't just a yes/no question. Learn to diagnose the different flavors of 'down' from DNS issues to server holds and HTTP errors.

Updated: 2025-10-20

Key Factors in Domain Suspension

When evaluating a domain for suspension, there are a variety of data points considered before taken action.

Updated: 2025-11-19

Malware Takedowns

Getting malware-related domains taken down is one of the most difficult types of takedowns. This article explores the nuances of malware takedowns and how to increase your chances of success.

Updated: 2025-05-21

Common Scenarios and Paths for Domains in Takedowns

A look at the common ways that a domain is taken offline for engaging in DNS abuse.

Updated: 2025-11-19

Why Domain-Related Takedowns Fail

There are a lot of reasons why domain-related takedowns fail. This article explores some of the most common reasons.

Updated: 2025-12-02

Techniques

From WHOIS to What Now? Infrastructure Tracking in the Privacy Era

The golden age of unredacted WHOIS records is dead. To track threat actors today, investigators must stop hunting for names and start fingerprinting infrastructure.

Updated: 2026-07-09

Beyond the List: Mapping Threat Infrastructure with Link Analysis

Stop looking at lists of domains and IPs. Start building a map. A practical guide to using link and network analysis to find the heart of a malicious network.

Updated: 2025-08-22

How I Investigate a Domain Name

A step-by-step guide to my personal workflow for investigating a domain, from WHOIS and DNS records to advanced OSINT pivoting techniques.

Updated: 2025-07-15

Checking Old Nameservers for Forgotten DNS Records

Leveraging lazy DNS record maintenance to uncover historical infrastructure details.

Updated: 2025-05-29

An OSINT Perspective on DNS Records

DNS records are more than just technical settings; they are digital fingerprints. Here's a guide to what they can reveal during an investigation.