What Does Domain OSINT Research Include?
Domain reconnaissance is the first phase of any security assessment, as outlined in NIST SP 800-115 (Technical Guide to Information Security Testing and Assessment) and the OWASP Testing Guide v4.2.
Max Intel's Domain OSINT tool lets you investigate any domain or website using more than 25 specialized intelligence tools from a single search. Enter a domain name, click Search, and the tool generates direct links to WHOIS databases, DNS analyzers, SSL certificate searchers, technology detectors, and security scanners.
What Does WHOIS Registration Data Reveal?
WHOIS lookups, defined by RFC 3912 and the newer RDAP protocol (RFC 7482), reveal domain registration details including the owner, registrar, registration date, and expiration date. As of 2025, ICANN manages over 370 million registered domain names globally. Max Intel links to SecurityTrails, DomainTools, Who.is, Whoisology, and ICANN Lookup for comprehensive registration data. Whoisology also provides historical WHOIS records showing ownership changes over time.
DNS Analysis
DNS records — standardized in RFC 1035 and extended by numerous subsequent RFCs — are fundamental to understanding a domain's infrastructure. Max Intel provides access to DNSdumpster, MXToolbox, DNSlytics, RobTex, Complete DNS, and ViewDNS for querying A, MX, NS, TXT, CNAME, and other record types. These tools also visualize DNS relationships and can reveal hosting infrastructure, mail servers, and associated domains.
- A / AAAA Records
- Map a domain to its IPv4 (A) or IPv6 (AAAA) server address — the fundamental records revealing hosting infrastructure.
- MX Records
- Identify mail servers handling email for the domain — essential for email security assessment and phishing investigation.
- TXT Records
- Contain SPF, DKIM, and DMARC policies, domain verification tokens, and other machine-readable data critical for email authentication analysis.
- NS Records
- Identify authoritative nameservers, revealing DNS hosting providers and infrastructure dependencies.
- CNAME Records
- Alias one domain to another — can expose CDN providers, cloud hosting, and third-party service integrations.
What Do SSL Certificates Reveal About a Domain?
SSL certificate analysis via crt.sh, Censys, and SSL Shopper reveals certificate details, alternative names (which can expose related domains and subdomains), and certificate chain information. Security scanning through VirusTotal, Shodan, and Netlas.io can identify malware, exposed services, and vulnerabilities.