Direct answer
Confirm a domain's owner with the responsible organization and obtain explicit written authorization for the specified systems and methods. DNS resolution and public registration information can provide context but do not themselves authorize security testing.
Define the asset
Write down the exact domain, environment and intended purpose. A company may use a third party for hosting or a service at a subdomain; determine who operates the application and who can authorize testing of each component.
Record the person providing authorization and the expected business owner, rather than assuming a brand name in a hostname establishes control.
Reference: NIST SP 800-115: Technical information security testing.
Use public records as leads
DNS can show where a name resolves. Registration lookup may show administrative information or privacy-protected records. These records can be stale or managed by a provider, so compare them with the organization's own verified inventory and ask the asset owner to resolve conflicts.
Reference: ICANN: Registration data lookup.
Set the rules of engagement
Agree in writing on target names and addresses, testing window, methods, source IPs, exclusions, rate limits and emergency contacts. Clarify whether testing shared infrastructure, external vendors or production systems requires separate approval.
- Identify in-scope hosts and explicitly excluded services.
- Agree safe test accounts and data where authenticated testing is included.
- Record stop conditions and evidence-handling requirements.
Maintain the boundary
A discovered subdomain or IP address is a candidate for the owner to verify, not an automatic extension of the scope. If ownership is unclear or the host changes during the engagement, pause the dependent test and obtain a scope update.
Assessment limits
Ownership can be shared or delegated, and a domain can change service providers. Public information and a DNS verification mechanism do not replace a complete agreement or permission from other affected parties.
Frequently asked questions
Does a public website grant permission to scan it?
No. Obtain authorization from the relevant owner and agree the methods and scope before active testing.
Does an IP address shared by two domains mean both are in scope?
No. Shared hosting can serve multiple unrelated customers; authorization must cover the actual assets and activities.
Primary sources and further reading
These guides combine published security guidance with practical assessment planning. Adapt checks to the owner's policy, environment, and authorized scope.
This guide was prepared with AI assistance using the linked sources and illustrative examples. Check current vendor guidance and your environment before making changes.