Domains and DNS

How do I find out who hosts a website?

“Who hosts this site” is three different questions — who serves the DNS, who owns the IP address, and who terminates the TLS — and on any modern site behind a CDN the answers are three different companies.

Do three lookups in order: the domain’s name servers, which usually name the DNS or hosting provider; the A record’s IP address and the network that owns it; and the TLS certificate, whose issuer and subject often name the platform. If the IP belongs to Cloudflare, Fastly, Akamai or another CDN, you have found the edge and not the origin — the real host sits behind it and is deliberately not published. In that case the name servers and the mail records are the best remaining evidence.

Worked out 2026-09-10 (IST) · Public DNS, WHOIS/RDAP and certificate data only

The three lookups

What each one reveals
Lookup	What you learn	Where it misleads
NS records	The DNS provider, often the same company as the host	Says nothing about where pages are served from
A / AAAA record → IP owner	The network that owns the address	Shows the CDN, not the origin, on a proxied site
TLS certificate	Issuer, subject organisation and every SAN hostname	A shared platform certificate names the platform, not the site owner
MX records	The mail provider — and sometimes the origin network	Often Google or Microsoft, which tells you little
TXT records	Which SaaS platforms the domain is verified with	Stale records survive for years after a service is dropped

Recognising who owns an IP

Common network owners
If the IP belongs to	You have found
Cloudflare	A CDN edge. The origin is hidden.
Amazon AWS	EC2, Lightsail, CloudFront or a customer VPC — too broad to be conclusive
Google Cloud / Google LLC	GCP, App Engine or Firebase Hosting
Microsoft / Azure	Azure or Microsoft 365 infrastructure
DigitalOcean, Linode, Hetzner, OVH, Vultr	A VPS. Usually the genuine origin.
Fastly, Akamai, Bunny	A CDN edge
GoDaddy, Hostinger, Bluehost, HostGator	Shared hosting — and this is the real origin
E2E Networks, CtrlS, Netmagic	An Indian data centre or cloud provider

Certificate transparency, the underrated source

Every publicly trusted TLS certificate is logged to append-only certificate transparency logs, and those logs are searchable by domain. They routinely surface subdomains nobody meant to publish — staging., admin., vpn. — because a certificate was issued for them at some point. For working out what infrastructure an organisation runs, CT logs beat every other public source.

Sources: RFC 6962 (Certificate Transparency); regional internet registry allocation data; public DNS.

Check your own numbers

Resolve A, NS, MX and TXT records to trace the infrastructure behind a domain.

DNS LookupA, AAAA, MX, NS, TXT and CNAME records, live from the resolver.

Frequently asked

Can I find the real server behind Cloudflare?

Not reliably, and that is the product working as intended. What sometimes leaks the origin is a mail server on the same network as the website, an old A record for a subdomain that was never proxied, or a certificate transparency entry naming an internal hostname. None of these is guaranteed and none is a lookup you can just run.

Why do the name servers say one company and the IP another?

Because DNS hosting and web hosting are separate services and most sites split them. A domain can sit at Cloudflare for DNS, serve pages from a droplet at DigitalOcean and route mail through Google Workspace. All three are visible, in different records.

Is it legal to look up a website's host?

Yes. Everything involved - DNS records, IP allocation records, certificate transparency logs - is published deliberately as public infrastructure data. You are reading a directory, not probing a system.

How do I report abuse to a host?

Find the network owner for the IP address and use the abuse contact published in its registry record; every allocation is required to carry one. For domain-level abuse - phishing, trademark - the registrar's abuse contact from WHOIS is the right channel instead, and it is mandatory under the Registrar Accreditation Agreement.

Need domain and DNS checks inside your own product?

We build WHOIS, RDAP, DNS and SSL lookups as embeddable widgets or a plain JSON API in your branding, wired to your own lead form. Tell us which checks you need and we will send a working demo.