Glossary term
Hostname
A hostname is a human-readable name for a machine or service on a network, such as www.example.com, resolved to an IP address through the DNS.
What Hostname means
A hostname is the human-readable name given to a machine or service on a network. On the public internet, the hostnames people see and type are fully qualified domain names — labels such as www.example.com, mail.google.com, or api.github.com. Each is a dotted sequence of labels read right to left: the rightmost label is the top-level domain, the label before it is the registered domain, and everything further left is a subdomain the domain's owner controls. The hostname is the name; the numeric IP address it points to is the location. The Domain Name System exists to translate the one into the other, so people and software can refer to services by stable, memorable names instead of addresses that change.
When a browser, mail server, or API client needs to reach a hostname, it performs DNS resolution. A resolver walks the DNS hierarchy — asking the root servers where the top-level domain lives, then that registry's name servers where the registered domain lives, then the domain's authoritative name servers for the specific record — until it gets an answer. That answer is usually an A record (an IPv4 address) or an AAAA record (an IPv6 address), and a single hostname can map to several addresses for load balancing, geographic distribution, or redundancy. Other record types attach further meaning to the same name: MX records say which servers accept mail for the domain, CNAME records alias one hostname to another, and TXT records carry policy data such as SPF and DKIM. A hostname is therefore not a single fact but a junction where many kinds of infrastructure meet.
It helps to separate three ideas that the word "hostname" is often used loosely to cover. A label is one segment between dots. A fully qualified domain name is the complete dotted path that names a specific point in the DNS tree. The registered or registrable domain is the part an owner actually buys from a registrar — typically the registered domain plus its top-level domain, though some suffixes allow registration deeper in the tree, which is why the Public Suffix List exists to encode where the registrable boundary falls. www.example.com and example.com are different hostnames that frequently resolve to the same or related infrastructure, but they are distinct names with distinct records, and treating them as interchangeable hides real differences an analyst may care about.
Hostnames carry a great deal of analytical signal, which is why they sit at the center of infrastructure mapping. Following the records attached to a name reveals the IP addresses it resolves to, and from those addresses the routed prefix and the autonomous system that announces it — connecting a friendly name to the network operator actually serving it. The registered domain links to WHOIS registration data: who registered it, through which registrar, and when. The top-level domain situates the name in the global namespace and hints at the registration norms and jurisdiction it falls under. Grouping hostnames by the organization that controls them, or by the ASN that hosts them, exposes the shape of a provider's footprint. Each of these pivots starts from a hostname and follows an edge to an adjacent fact.
The same structure makes hostnames central to security work. Attackers register names that look like trusted brands — swapping a letter, using a confusable character, or registering the same string under a cheaper top-level domain — to deceive people who read the name without inspecting where it resolves. Comparing a suspicious hostname against known-good infrastructure, checking whether its resolved addresses appear on threat-intelligence feeds, and examining how recently the registered domain was created are routine steps in triaging a name. Because a hostname is the thing a victim sees and a defender can pivot from, it is both the bait in many attacks and the starting point for unraveling them.
A few practical points round out the picture. Hostnames are case-insensitive: Example.COM and example.com name the same entity, so systems normalize to lowercase. Most labels use letters, digits, and hyphens, but internationalized domain names encode non-ASCII characters into an ASCII form for the wire, and some DNS labels begin with an underscore — names like _dmarc.example.com — to carry machine-readable policy rather than to name a reachable host. Resolution is also not guaranteed to be stable or singular: the answer can vary by resolver, by geography, and over time, which is exactly why a name is a more durable identifier than any single address it returns.
Whisper Canon treats the hostname as a primary entity. Each hostname page states what the name resolves to, which networks and organizations stand behind those addresses, how the name is registered, and where it sits relative to its apex domain and top-level domain — turning a single name into a navigable map of the infrastructure beneath it. The hostname is where most investigations begin, because it is the layer of the internet that humans actually read.
Examples in Whisper Canon
Concrete pages in the directory that illustrate Hostname.