DNSDB rdata lookups

Rdata lookups query DNSDB’s Rdata index, which supports “inverse” lookups based on Rdata record values. In contrast to rrset lookups, rdata lookups return only individual resource records (not full resource record sets) and lack bailiwick metadata.

URL Path Scheme

/dnsdb/v2/lookup/rdata/TYPE/VALUE/RRTYPE

Both TYPE and VALUE are required. The RRTYPE parameter is optional.

Type Parameter

The TYPE parameter specifies how VALUE is interpreted:

Type	Description
name	The `VALUE` is a DNS domain name in presentation format, or a left-hand (“.example.com”) or right-hand (“www.example.”) wildcard domain name. Note that left-hand wildcard queries are somewhat more expensive than right-hand wildcard queries.
ip	The `VALUE` is one of an IPv4 or IPv6 single address, with a prefix length, or with an address range. If a prefix is provided, the delimiter between the network address and prefix length is a single comma (”,”) character rather than the usual slash (”/”) character to avoid clashing with the HTTP URI path name separator.
raw	The `VALUE` is an even number of hexadecimal digits specifying a raw octet string.

RRtype Parameter

If RRTYPE is not specified, the query functions as if “ANY” was specified.

For name and raw rdata lookups, RRTYPE optionally filters the results by RRtype in the same manner as rrset lookups
For ip rdata lookups, the supported RRTYPE values are A, AAAA, and ANY, which can be used interchangeably: you can send an IPv4 or IPv6 address to either value and the data returned will be based on the IP address sent, not on the RRTYPE value
Any other RRTYPE value for ip lookups will return an “HTTP 400 Bad Request” response

IP Address Examples

Some examples of “ip” rdata URLs (noting that colon needs to be expressed as %3A):

https://api.dnsdb.info/dnsdb/v2/lookup/rdata/ip/10.0.0.1/ANY
https://api.dnsdb.info/dnsdb/v2/lookup/rdata/ip/10.0.0.1-10.1.255.255
https://api.dnsdb.info/dnsdb/v2/lookup/rdata/ip/10.0.0.1,24/ANY
https://api.dnsdb.info/dnsdb/v2/lookup/rdata/ip/2620%3A11c%3Af008%3A%3A,126
https://api.dnsdb.info/dnsdb/v2/lookup/rdata/ip/2620%3A11c%3Af008%3A%3A1-2620%3A11c%3Af008%3A%3Aff

Result Format

Results are returned in JSON Lines format with the following keys:

Key	Description
rrname	The owner name of the resource record in DNS presentation format.
rrtype	The resource record type of the resource record, either using the standard DNS type mnemonic, or an RFC 3597 generic type, i.e. the string `TYPE` immediately followed by the decimal RRtype number.
rdata	The record data value. The Rdata value is converted to the standard presentation format based on the rrtype value. If the encoder lacks a type-specific presentation format for the resource record’s type, then the RFC 3597 generic Rdata encoding will be used.
count	The number of times the resource record was observed via passive DNS replication.
time_first, time_last	UNIX epoch timestamps with second granularity indicating the first and last times the resource record was observed via passive DNS replication.
zone_time_first, zone_time_last	UNIX epoch timestamps with second granularity indicating the first and last times the resource record was observed via zone file import.

Examples

Example 1: Lookup records with IPv4 address 104.244.13.104

curl -H "Accept: application/x-ndjson" -H "X-API-Key: $DNSDB_API_KEY" \
  "https://api.dnsdb.info/dnsdb/v2/lookup/rdata/ip/104.244.13.104"

Response:

{"cond": "begin"}
{"obj":{"count":24,"time_first":1433550785,"time_last":1468312116,
    "rrname":"www.farsighsecurity.com.","rrtype":"A","rdata":"104.244.13.104"}}
{"obj":{"count":9429,"time_first":1427897872,"time_last":1468333042,
    "rrname":"farsightsecurity.com.","rrtype":"A","rdata":"104.244.13.104"}}
{"cond": "succeeded"}

Example 2: Lookup records in 104.244.13.104/29 network

curl -H "Accept: application/x-ndjson" -H "X-API-Key: $DNSDB_API_KEY" \
  "https://api.dnsdb.info/dnsdb/v2/lookup/rdata/ip/104.244.13.104,29"

Response (with keep-alive messages):

{"cond": "begin"}
{}
{"obj":{"count":24,"time_first":1433550785,"time_last":1468312116,
    "rrname":"www.farsighsecurity.com.","rrtype":"A","rdata":"104.244.13.104"}}
{"obj":{"count":9429,"time_first":1427897872,"time_last":1468333042,
    "rrname":"farsightsecurity.com.","rrtype":"A","rdata":"104.244.13.104"}}
{}
{"cond": "succeeded"}

Example 3: Lookup records with IPv6 address

curl -H "Accept: application/x-ndjson" -H "X-API-Key: $DNSDB_API_KEY" \
  "https://api.dnsdb.info/dnsdb/v2/lookup/rdata/ip/2620:11c:f004::104"

Response:

{"cond": "begin"}
{"obj":{"count":14,"time_first":1433845806,"time_last":1467828872,
    "rrname":"www.farsighsecurity.com.","rrtype":"AAAA","rdata":"2620:11c:f004::104"}}
{"obj":{"count":5307,"time_first":1427897876,"time_last":1468333042,
    "rrname":"farsightsecurity.com.","rrtype":"AAAA","rdata":"2620:11c:f004::104"}}
{"cond": "succeeded"}

Example 4: Lookup records in IPv6 network prefix

curl -H "Accept: application/x-ndjson" -H "X-API-Key: $DNSDB_API_KEY" \
  "https://api.dnsdb.info/dnsdb/v2/lookup/rdata/ip/2620:11c:f000::,126"

Response:

{"cond": "begin"}
{"obj":{"count":2,"time_first":1574082633,"time_last":1574082633,
    "rrname":"gw.fmt1.fsi.io.","rrtype":"AAAA","rdata":["2620:11c:f000::1"]}}
{"obj":{"count":261,"time_first":1573589461,"time_last":1576188661,
    "rrname":"r1.fmt1.fsi.io.","rrtype":"AAAA","rdata":["2620:11c:f000::2"]}}
{"obj":{"count":241,"time_first":1573611061,"time_last":1576188661,
    "rrname":"r2.fmt1.fsi.io.","rrtype":"AAAA","rdata":["2620:11c:f000::3"]}}
{"cond": "succeeded"}

Example 5: Lookup domains delegated to nameserver

curl -H "Accept: application/x-ndjson" -H "X-API-Key: $DNSDB_API_KEY" \
  "https://api.dnsdb.info/dnsdb/v2/lookup/rdata/name/ns5.dnsmadeeasy.com"

Response:

{"cond": "begin"}
{"obj":{"count":1078,"zone_time_first":1374250920,"zone_time_last":1468253883,
    "rrname":"farsightsecurity.com.","rrtype":"NS","rdata":"ns5.dnsmadeeasy.com."}}
{"obj":{"count":706617,"time_first":1374096380,"time_last":1468334926,
    "rrname":"farsightsecurity.com.","rrtype":"NS","rdata":"ns5.dnsmadeeasy.com."}}
{"cond": "succeeded"}

Example 6: Lookup domains with mail exchanger

curl -H "Accept: application/x-ndjson" -H "X-API-Key: $DNSDB_API_KEY" \
  "https://api.dnsdb.info/dnsdb/v2/lookup/rdata/name/hq.fsi.io"

Response:

{"cond": "begin"}
{"obj":{"count":45644,"time_first":1372706073,"time_last":1468330740,
    "rrname":"fsi.io.","rrtype":"MX","rdata":"10 hq.fsi.io."}}
{"obj":{"count":19304,"time_first":1374098929,"time_last":1468333042,
    "rrname":"farsightsecurity.com.","rrtype":"MX","rdata":"10 hq.fsi.io."}}
{"cond": "succeeded"}

Example 7: Raw query for records

curl -H "Accept: application/x-ndjson" -H "X-API-Key: $DNSDB_API_KEY" \
  "https://api.dnsdb.info/dnsdb/v2/lookup/rdata/raw/0366736902696f00?limit=2"

Response:

{"cond": "begin"}
{"obj":{"count":6,"time_first":1413228451,"time_last":1413228451,
    "rrname":"local-data.fsi.io.","rrtype":"SOA",
    "rdata":"fsi.io. hostmaster.fsi.io. 2014050101 7200 3600 604800 3600"}}
{"obj":{"count":25,"time_first":1412912798,"time_last":1412942807,"rrname":"dnstap.info.",
    "rrtype":"SOA","rdata":"fsi.io. hostmaster.fsi.io. 2014052824 7200 3600 25920000 3600"}}
{"cond": "limited", "msg": "Result limit reached"}