I built a script that queries the domain registry. Just a disclaimer, this is NOT a hacking attempt. I am trying to gather a list of domains that my company does NOT host. Lets assume that the NameServer my company owns is ns.foo.net and my script does the following:

  1. Checks whois to find the Name Server of each domain.
  2. Then checks to see if the A record (querying the NameServer found) matches our IP address.
  3. If the Name Server is not ours AND the A record of the domain is not ours, add to a list. Otherwise, ignore it and move on through the list.

Let us also assume the list of domains are as follows:


Here is my script:


REGEX="Name Server"

#Read from Text file
while read -r line; do
        SERVER=`whois "$line" | grep -m 1 "$REGEX" | awk '{print $3}'`
        shopt -s nocasematch
        HOST=`host -ta "$line" "$SERVER"`
        if [[ ! "$SERVER" =~ foo.net && ! "$HOST" =~ "$OUR_IP" ]]; then
                echo "$line" >> results.txt
        sleep 1;

I am noticing that the domains being added contains an A record of $OUR_IP and sometimes foo.net (my domain). What could be wrong with the if statement that is breaking the logic?

  • Why not configure your services to not serve a name that you haven't configured in them? IE, for apache, use virtual hosts with a catch-all that serves nothing, or perhaps a message like "bar.com isn't hosted here" – ivanivan Aug 18 '17 at 19:52
  • Well im not trying to generate a message with apache. I need to collect a list of customers we serve that chose not use our DNS – ryekayo Aug 18 '17 at 19:57
  • The DNS would be a better source of information for that task than whois. – Patrick Mevzek Aug 19 '17 at 14:01
  • Patrick Mevzek is completely right - you shouldn't be using whois for this task and you will have issues as the whois queries may be capped. Not to mention that whois is TLD-dependent, thus the output can vary a lot and will make parsing problematic. Some ccTLDs (country code extensions) could give you a hard time. Instead do regular queries using dig or nslookup. eg: dig -t NS +short domain.com to get the list of name servers used by a particular domain name. Then you query the name servers found to obtain the A record(s) you are interested in. – Anonymous Aug 21 '17 at 0:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.