When a company’s homepage returns DNS_PROBE_FINISHED_NXDOMAIN, the DNS resolver cannot find a record for the host name you requested. This can be caused by a misconfiguration, expired domain, propagation lag after a recent change, the use of a different host name (e.g., apex vs. “www”), or an abandoned brand. It does not, by itself, signal fraud—but it blocks normal due diligence because the primary source of truth is unreachable.

For security, risk, and procurement teams, the correct response is a disciplined open-source intelligence (OSINT) workflow that can both verify a company’s identity and create an auditable trail. The following playbook lays out a practical, step-by-step approach: confirm the domain spelling, interrogate DNS/WHOIS (including passive DNS), recover historical content, triangulate against LinkedIn and the broader web (including corporate registries and trade references), and document findings rigorously.

Step 1 — Validate the Domain Itself

Begin by ensuring you are assessing the right string and host name.

• Confirm spelling and host variation:

  • Check for typosquats (e.g., transposed letters, hyphenation, homographs) and TLD swaps (.com vs .co, .io, .ai).
  • Try apex and common subdomains: example.com, www.example.com, app.example.com.
  • If the error appears only on “www,” query the apex; some sites intentionally do not use “www.”

• Run basic DNS diagnostics (use at least two resolvers to rule out local cache issues):

  • dig example.com +trace
  • dig A/AAAA records for apex and www: dig example.com A; dig www.example.com A
  • Check NS and SOA: dig example.com NS; dig example.com SOA
  • Inspect MX and TXT (SPF/DMARC) to see if the domain is otherwise active: dig example.com MX; dig example.com TXT
  • Note time-to-live (TTL) values and name servers; very recent changes or mismatched name servers can explain transient NXDOMAIN.

• Examine WHOIS/registrar data:

  • Use ICANN Lookup or a WHOIS client to capture registrar, registration date, expiration date, and name servers.
  • Red flags: newly registered domains with privacy-protected registrants claiming to represent long-established companies; frequent recent name server changes; past drops and re-registrations.
  • If the domain expired recently, NXDOMAIN may reflect lapse rather than fraud.

• Consult passive DNS and Certificate Transparency (CT):

  • Passive DNS (e.g., SecurityTrails, DNSDB, RiskIQ) can reveal historical A/CNAME/MX records and subdomains (api., mail., portal.), indicating prior active use.
  • CT logs (e.g., crt.sh) list issued TLS certificates for the domain and subdomains, often containing organization names, cities, or CAs used. Compare organization fields with claimed company identity.
  • A healthy historical footprint (consistent subdomains, long-lived MX, regular certificate issuance) supports legitimacy; a barren or very recent footprint may warrant caution.

Interpretation guidance:

• Consistent historic infrastructure, mail configuration, and CT entries suggest a real operating domain undergoing a temporary outage or change.
• Inconsistent registrant details, recent ownership transfers, or no historical signals raise the likelihood of brand impersonation or defunct operations.

Step 2 — Recover Prior Site Content from Archives and Caches

If the live site is unavailable, reconstruct what used to be there to assess identity claims, products, and contact data.

• Wayback Machine (web.archive.org):

  • Search the apex and common subpages (/, /about, /contact, /pricing). Review the capture timeline for stability and recency.
  • Prefer captures with full HTTP 200 responses and embedded asset retrieval; screenshot-only captures can miss critical text.
  • Extract and preserve: company name, legal entity, addresses, phone numbers, executive names, email domains, product names, logos, policy documents (privacy, terms), and any registration or certification numbers.

• Other caches and mirrors:

  • Bing or Yandex cached pages may still hold snapshots; search operators like site:example.com can surface indexed URLs.
  • Use Memento aggregators to query multiple archives at once (e.g., Timetravel or Memento TimeGate).
  • Check CDN error pages or status pages referenced by archived content (status.example.com).

• Cross-check and corroborate:

  • Compare historical contact information across multiple snapshots to see if details are stable over time.
  • Note any rebranding events (e.g., change from Example Labs Inc. to Example Technologies LLC) and timeline them.
  • Save hashes of downloaded artifacts (e.g., PDFs of terms) to ensure integrity of evidence.

Interpretation guidance:

• Stable branding, consistent contact coordinates, and policy documents over months/years support continuity.
• Sudden changes in logo, legal name, or jurisdiction without announcements may indicate acquisition, pivot, or a takeover of the domain—each demanding further verification.

Step 3 — Triangulate Identity on the Wider Web

With foundational technical and archival signals in hand, validate the company’s existence and identity through independent sources.

• LinkedIn and employment signals:

  • Locate the company page. Verify that the listed website matches the domain under review and check for LinkedIn’s domain verification features, if present.
  • Review employee profiles: do email domains, job descriptions, and tenure align with the archived site’s narrative? Do senior staff list the same physical address or region?
  • Examine hiring activity and job posts for references to the domain, tech stack, or legal entity.

• Corporate registries and compliance listings:

  • Jurisdictional registries: Companies House (UK), state Secretary of State portals (US), Quebec REQ, ASIC (AU), etc. Match legal name, registration number, status (active/dissolved), and registered office.
  • Global aggregators: OpenCorporates, GLEIF (LEI lookups), and, for public issuers, SEC EDGAR or equivalent national securities filings.
  • Regulated sectors: FINRA BrokerCheck (US finance), FDA/EMA databases (life sciences), or national contractor/license boards. Confirm that any claimed licenses are valid and match the legal entity.

• Trade references and business reputation:

  • Vendor directories, partner portals, and case studies from recognizable counterparties. A named integration partner or customer quote on the archived site should be validated on the counterparty’s site.
  • Business bureaus and review platforms (BBB, Trustpilot, Google Business Profile) for consistent NAP (name-address-phone) data and patterns in feedback. Treat anonymous or unverified reviews cautiously.
  • Procurement and payment networks (e.g., supplier onboarding portals) where the company may have a profile, D‑U‑N‑S number, tax IDs, or bank verification artifacts.

• Web presence beyond the main site:

  • Press releases on reputable newswires; media coverage linking executives and the legal entity.
  • Engineering or developer ecosystems (GitHub orgs, npm/PyPI packages) referencing the domain in READMEs or commit metadata.
  • Marketing collateral stored elsewhere (SlideShare, YouTube, PDF hosts) bearing the same brand and contact details.

Corroboration checklist:

• Do the legal entity, domain, and street address co-occur across multiple independent sources?
• Are executive names consistent across LinkedIn, filings, and press?
• Do third parties acknowledge the relationship (partners, customers, regulators), not just the company itself?

Step 4 — Synthesize Findings and Assess Risk

Aggregate all signals to reach a defensible, risk-informed conclusion.

• Indicators of legitimacy (weight increases with time depth and cross-source consistency):

  • Longstanding domain with stable DNS/WHOIS; historical subdomains and CT issuance cadence.
  • Archived site content with consistent branding, policies, and contact details.
  • Confirmed legal entity in the expected jurisdiction; active status and matching registered office.
  • Independent confirmation via partner/customer sites and verified social/company pages.
  • Active email posture (MX, SPF, DMARC) and evidence of ongoing operations (recent hiring, filings, releases).

• Indicators requiring caution or escalation:

  • Newly registered or recently transferred domain purporting to represent a mature brand.
  • No passive DNS or CT history; lack of MX/SPF/DMARC suggesting the domain is dormant.
  • Discrepancies between claimed and registered legal names, addresses, or directors.
  • Only self-referential evidence; no third-party attestations.
  • Reviews or advisories indicating non-delivery, chargebacks, or regulatory actions.

Decision pathways:

• Proceed with low risk: Multiple strong corroborations; NXDOMAIN likely due to transient DNS misconfiguration. Request a corrected host name from the counterparty and ask for a current point of contact using a verifiable corporate email domain.
• Proceed with controls: Some corroboration but gaps remain. Limit exposure (e.g., capped PO, milestone-based payments), and require supplementary documents (COI, W‑9/W‑8, bank letter) that match registry data.
• Pause and escalate: Material inconsistencies or weak signals. Seek direct confirmation through a phone number obtained from a registry filing or known partner, not from unverified emails or the downed website.

Step 5 — Log an Auditable Trail

Good OSINT is reproducible. Document every step so peers, auditors, or investigators can follow your path.

• Capture methodology:

  • Timestamp all actions and record the environment (VPN location, resolver used). Note whether results differ across networks.
  • Take screenshots of key findings with visible URLs and timestamps; save raw HTML and HTTP headers where relevant.
  • Preserve artifacts: WHOIS outputs, dig results, CT entries, registry filings, PDFs. Store cryptographic hashes for static documents.

• Structure your dossier:

  • Executive summary: objective, scope, conclusion, and confidence level.
  • Evidence sections aligned to this workflow: domain/DNS, archives, external corroboration, registries/trade references.
  • Findings matrix: each claim (e.g., legal name, address, ownership) mapped to sources and corroboration count.
  • Risk assessment and recommendation: go/no‑go/conditional, plus required mitigations.

• Maintain integrity and compliance:

  • Use only publicly accessible information and avoid intrusive or unlawful tactics.
  • Respect privacy and data minimization; collect only what is necessary for verification.
  • Version-control your dossier and ensure chain-of-custody for evidence used in decisions.

By following this playbook, teams can convert a blocking NXDOMAIN error into a structured inquiry that either re-establishes trust with a provably real company or avoids engagement with a dubious entity. The rigor of your process—and the quality of your evidence—are what make your decision defensible.