Domain History Analysis: The Indie Hacker's Guide to DNS Archaeology

What do you need before starting domain history analysis?

You need a domain name, a browser, and a terminal. That's the baseline. For deeper checks, you'll want free accounts at SecurityTrails and VirusTotal.

Budget-wise, you can do a basic domain history analysis for $0. Paid tools like DomainTools run $99 to $299 per month. Start with free tools.

dead.domains has buried 0 projects to date, and you won't find much there yet. But you can browse the graveyard to see how empty it is.

Step 1: How do you pull current DNS records?

Open a terminal and run dig example.com A, dig example.com MX, and dig example.com NS. This gives you the current IP, mail server, and nameservers. Google's public DNS lookup at dns.google is a browser alternative.

Write down the TTL values. A TTL of 300 seconds means the record is cached for 5 minutes. This step takes about 10 minutes.

It tells you where the domain points now, not where it's been. That's where history tools come in. For a more complete picture, also run dig example.com TXT.

TXT records often contain SPF and DKIM entries that reveal email sending history. You might see a Google Workspace entry from 2015, which suggests the domain used Gmail. A missing TXT record after 10 years of history is itself a clue.

Some domains have TXT records that say 'verification code' from a service you've never heard of. That means someone used the domain for something specific.

Step 2: How do you trace historical WHOIS data?

Current WHOIS only shows the current owner. For history, you need a data provider. SecurityTrails offers 50 free lookups per month, then paid plans start at $39/month.

DomainTools has a bigger historical index, but it costs $99/month and up. ICANN's own lookup tool is free for current records. Enter the domain and look for registration dates, previous registrants, and nameserver changes.

A domain registered in 1998 that changed hands 6 times is a different risk than one held by the same owner for 20 years. Privacy protection can hide most of this. Don't expect a complete picture.

A domain might look clean on the surface. The current owner could have held it for 5 years, while the previous owner was a known spam operation. That domain might have been used for email phishing in 2019.

The only way to catch it is to find a cached record from before privacy protection kicked in. Without that, you could overpay by $300.

Step 3: How do you use DNS history services for domain history analysis?

This is where domain history analysis gets interesting. Services like ViewDNS.info's DNS History and SecurityTrails' Passive DNS let you see old DNS records. Passive DNS captures what resolvers saw over time, letting you spot when a domain pointed to a Russian IP in 2015 and a Canadian server in 2020.

ViewDNS.info gives you 15 free lookups per day. After that, it's $49 for a lifetime subscription. I once used this to find out a domain I wanted was previously hosting a phishing page.

That saved me $500 on a bad purchase. You should also check DNS history for subdomains. A domain might have had a mail. subdomain pointing to a mail server in 2014, then a dev. subdomain pointing to a staging server in 2016.

These subdomains can reveal the previous owner's tech stack. For example, a cpanel. subdomain suggests shared hosting, while a git. subdomain suggests a developer. This information helps you guess whether the domain was a hobby project or a business.

It also helps you estimate how much maintenance the domain received.

Step 4: How do you check the Wayback Machine for past content?

The Wayback Machine at web.archive.org has over 900 billion URLs. Enter the domain and you'll see a calendar of snapshots. Click one from 2010 and you might see a restaurant site.

Click one from 2016 and it's a casino link farm. That's a classic red flag. The CDX API is free and lets you pull a list of all snapshots in one request.

A typical snapshot history can be reviewed in 20 minutes. For a deeper look, use the Site Map or search for specific URLs. This step costs $0 and takes 30 to 60 minutes.

Don't just look at the homepage. Check the archived URLs for /blog, /shop, or /admin. You might find old login pages, error messages, or even a robots.txt that reveals which directories were hidden.

The Wayback Machine also captures response headers. You can see the server software and whether the site used HTTPS. A domain that switched from HTTP to HTTPS in 2018 was probably being maintained.

A domain that stayed on HTTP until 2023 was likely abandoned.

Step 5: How do you look up backlinks and mentions?

Backlinks tell you what other sites thought of this domain. Ahrefs is the gold standard, but it starts at $99/month. A free alternative is OpenLinkProfiler, which gives you a sample of links.

Search Google for 'example.com' to find mentions, but that only scratches the surface. If the domain has links from adult sites or spam directories, that's a warning. If it has links from reputable tech blogs, that's a good sign.

You can also check if the domain is listed on dead.domains, but with 0 projects buried, you won't find any backlinks there yet. Bury your dead project if you want to change that.

For a more complete backlink profile, use the free version of Moz Link Explorer. It gives you up to 10 queries per month. You'll see the top 50 backlinks for any domain.

Look at the anchor text. If most anchors are 'cheap viagra' or 'casino', the domain was used for spam. If the anchors are the domain name itself, that's more natural.

Also check the referring domains. A domain with 5 referring domains is not the same as one with 500. You can see the exact numbers in Moz's free dashboard.

Step 6: How do you piece together a domain history analysis timeline?

Now you have DNS records, WHOIS history, archived pages, and backlinks. Put them on a spreadsheet. Columns: year, registrar, nameserver, IP address, content type, and notable events.

For example, a domain might show: 2005 registered, 2007 parked, 2010 WordPress blog, 2015 redirect to a different domain, 2020 for sale. This timeline tells you if the domain was abandoned, penalized, or actively developed. Also check Google Safe Browsing and VirusTotal for security flags.

VirusTotal is free and gives a score from 0 to 100. A score under 10 means the domain is probably clean. You can also use the timeline to estimate a fair purchase price.

A domain with 15 years of consistent content and 300 referring domains is worth more than a domain with 3 years of spam and 20 links. dead.domains doesn't have any projects to compare, since it has buried 0 domains to date. But you can use your own judgment.

If the timeline shows a clear story, you can negotiate with the seller. If the timeline is full of gaps, ask for a discount. The seller might not know the domain's history, but now you do.

What can go wrong during domain history analysis?

You might hit privacy protection and get zero WHOIS history. You might find contradictory DNS records because of shared hosting. You might overreact to a single bad snapshot.

I once rejected a domain because it had a spammy backlink profile, only to learn the backlinks were from a link injection attack. That's a common false positive. Also, free tools have gaps.

SecurityTrails might miss a year of DNS data. DomainTools might have the data but charge you $99 to see it. And dead.domains currently has 0 projects, meaning the most common cause of death is unknown, and the most common TLD is .com with 0 domains.

That's not helpful, but it's honest. Another risk is confirmation bias. If you want the domain to be clean, you'll ignore warning signs.

If you want to reject it, you'll focus on minor issues. To stay objective, write down your findings before making a decision. Use a checklist: current DNS, WHOIS history, Wayback snapshots, backlinks, security flags.

If any two sources show a red flag, take it seriously. If only one source shows a problem, dig deeper. This approach has saved me from two bad purchases in the last 5 years.