Finding Information About Domain Names

When you make a request to facebook.com, your computer looks up the domain name to translate that domain name into an IP address so your computer can make that connection. An IP address points to a computer on the Internet, but a domain name is easier to remember than a group of numbers. Domain Name System (DNS) servers store the mappings of IP addresses, along with other information. There are several command-line tools you can use to query these servers.

Use the dig command to “dig” through domain name records and find the IP addresses associated with those. It’s a reliable way to get information about a domain:

Look at the Answer Section to see the IP addresses. In this example, only one IP address is associated with this domain name. But use the dig command with google.com and you’ll see that they’ve associated more than one IP address. This is what sites do that need high availability. If one IP goes down, the others can answer.

Sometimes you need to find out who owns a domain name so you can contact them. Or you want to check if a domain name exists so you can purchase it. Some unscrupulous companies offer online domain searches, and when you search for a domain you want, they purchase it automatically so that when you go to pay for it, they can charge you more.

The whois command is a quick way to see if a domain name exists. If it does exist, you can see who owns it, along with contact information. The whois command uses domain name servers to query the registration information of a domain.

On Ubuntu, you may have to install the whois command with apt:

Now use it to look at the registration information for the pragprog.com domain:

When you run that, you’ll be greeted with a wall of information, including when the domain name expires and who to contact about it.

Based on this information:

1. Who would you contact about technical issues?
2. When was the domain first registered?
3. Why do you think there are so many name servers associated?

You can learn a lot about a domain with the whois command.

Sometimes you don’t know the domain name. Sometimes you only have the IP address. The host command makes it easy to look up a domain name from an IP. If you’re looking through security logs and you’re getting hits from a certain IP address, try using the host command to look up the domain name of the request:

This command tells you a lot about this IP address:

It looks like this IP belongs to Google. Try running this command with your own IP address. You might see a result like this:

A lot of residential internet providers register IP addresses in their own DNS servers just like this, which makes it easy to tell who’s the ISP. In this example, it looks like this IP address is associated with an ISP in Eau Claire, Wisconsin. With this knowledge, you can then get more information by contacting the ISP. Of course, you can’t guarantee this information, and you really can’t accurately tie an IP to a geographic region unless the owner of the IP helps you along like the ISP did in this example. Still, this is one tool of many that you can use to learn more about the IP addresses you’re communicating with.

Now, let’s look at how to test network connectivity.