2

It's been my understanding in the past years that it's not easily possible to find out all the subdomains of a domain (unless these are used publicly, like in hyperlinks, etc), and likewise not easily possible to find all domains/submains that are associated to a specific IP.

However, if I lookup any of my IP addresses or Domains in https://securitytrails.com/, it seems to know:

  1. ALL subdomains for all my domains, whether they're used publicly or privately (e.g. between colleagues)

  2. ALL domains and subdomains I use on my own home network/IP, that I never shared to public (but use on my own devices)

My DNS is managed mostly by AWS Route53 and Namecheap DNS.

I'd like to understand if my impression has been wrong. I understand how the public domains are known, and PTR/rDNS records can be used to find some, but I can't understand how the privately used subdomains can be found.

Is there anything that can be done, or that I can look into, that at least gives some "privacy" in relation to DNS?

I'm not looking for "security by obscurity", but whatever I can do to help hiding what's not supposed to be public, that would always be welcome.

Improve this question
3
  • This article at blog.appsecco.com/… can start to give you ideas on how names are "found".
    – Patrick Mevzek
    Dec 8, 2021 at 3:59
  • It is unclear what you mean with "never shared to public". How are these domains exactly setup, i.e. where is the mapping between hostname and IP address stored? Did you do this using a hosts file, a private DNS server not reachable from outside or some public DNS server? Also, are these easy to guess names where visiting a website on the internet could simply include code to check if your current browser (which can resolve the internal names) can connect to such a name?
    – Steffen Ullrich
    Dec 8, 2021 at 4:28
  • Apart from that I've looked at the specific site you mention - it does not even find all subdomains for an IP address I manage, even if they could be publicly resolved.
    – Steffen Ullrich
    Dec 8, 2021 at 4:33

0

Reset to default

You must log in to answer this question.

Browse other questions tagged .