Thanks everyone for the wonderful answers! The thoughts in my head were not aligned with reality ;-) I had a thought similar to what Bill describes, that everywhere there's a dot (.) there's a subdomain. I also had the thought/assumption that the data to the left of the leftmost dot (.) was essentially the hostname. It's been a while since I've regularly been into DNS but I thought I remembered it that way. But then seeing some of the OSINT data, that seemed to throw that idea out the window as they appear to use the publicsuffix.org site to divine suffix and domain and then consider everything to the left of that as a subdomain. I've now updated my understanding. Cheers, Harry On Mon, Feb 24, 2025 at 9:47 PM William Herrin <bill@herrin.us> wrote:
In working with several OSINT sources for domain processing it seems
On Mon, Feb 24, 2025 at 5:58 PM Harry Hoffman via NANOG <nanog@nanog.org> wrote: like the way domains and subdomains are processed essentially equates subdomains with FQDNs.
Hi Harry,
I don't understand what you mean. Do you mean how do local resolvers expand local names (e.g. "server") in FQDNs ("server.examplecompany.com")?
Has this become common practice? Is there a definitive way to determine subdomains? I seem to recall that "older" dns server software wouldn't allow this but it could be that my memory is faulty.
Subdomain is kinda a fuzzy question. Everywhere there's a dot there's a "subdomain," but the only technical meanings those dots have is that:
1. There *might* be a DNS delegation there. 2. The resolver's primitive internal compression algorithm can break the name in parts there when composing the query or response packet.
There's another similar question you might be trying to ask: how do you determine whether a DNS name has been delegated from one zone file at one server to another zone file at another server? That has a more precise answer with technical meaning: If a NS and SOA records exist at the "dot" boundary then there's a delegation. If not, then there isn't.
For example, I have a host named "cat.p.dirtside.com." "dirtside.com" is a delegation of "com" because there's an NS record for "dirtside.com." However, "p.dirtside.com" is NOT a delegation of "dirtside.com" because there's no NS record. "cat.p" is simply a name within the "dirtside.com" zone file.
Regards, Bill Herrin
-- William Herrin bill@herrin.us https://bill.herrin.us/