Queries domains, collects SOA and NS records and applies logic to see if it is controlled or merely hosted by the approved whitelist DNS IPs