DNSDB API User Guide
Introduction
Section titled “Introduction”DNSDB is a database that stores and indexes both passive DNS data (from Farsight Security’s Security Information Exchange, SIE) and authoritative DNS data provided by various zone operators. It allows searching for individual DNS RRsets, with additional metadata for search results, such as first seen and last seen timestamps and the DNS bailiwick for each RRset. DNSDB also supports inverse (rdata) searches.
DNSDB Capabilities and Limits
Section titled “DNSDB Capabilities and Limits”Access to DNSDB is licensed in several ways, with different interfaces and tools providing various capabilities and limits. Understand your license and toolset for quota and feature differences.
Trial Products
Section titled “Trial Products”| Product | Quota | Maximum Results | Duration | Data Available | Rate Limit | Query Privacy |
|---|---|---|---|---|---|---|
| Maltego Free Queries | 12/hour | 12 | N/A | 2010 to now | 12/hour | No |
To request a DNSDB demonstration, contact the DomainTools sales team.
Subscription Products
Section titled “Subscription Products”| Product | Quota | Maximum Results | Duration | Data Available | Rate Limit | Query Privacy |
|---|---|---|---|---|---|---|
| Queries per Day | 1K – Unlimited | 10K – 1M | 1 Year | 2010 to now | None | Yes |
User Guide Notes
Section titled “User Guide Notes”-
In Curl examples,
$APIKEYis an environment variable. Set it in the current shell with (example only):APIKEY="QmIodGqF12TKOf8bqBe6S6WxvZ4LTtzP1VlS09g0UApw28gedka545OcumVW4WHkB" -
API calls below use API Version 2.
-
Curl 7.42.0+ supports the
--path-as-isoption, preventing curl from merging/squashing/../or/./sequences.
Primary Pivots
Section titled “Primary Pivots”When investigating historical DNS data, five primary pivots are useful:
- Name → Answers (names and IPs)
- Wildcard left hand side
- Wildcard right hand side
- IP → Names
- Name → Names
Name → Answers
Section titled “Name → Answers”Specify a name to retrieve historical answers (A, AAAA, NS, MX, SOA, TXT, etc.). If no record type is specified, all are returned.
Hostname Example
Section titled “Hostname Example”- Hostname:
www.fsi.io
curl -s -H 'Accept: application/x-ndjson' -H "X-API-Key: $APIKEY" \ "https://api.dnsdb.info/dnsdb/v2/lookup/rrset/name/www.fsi.io?limit=10000"Second Level Domain Example
Section titled “Second Level Domain Example”- Hostname:
fsi.io
curl -s -H 'Accept: application/x-ndjson' -H "X-API-Key: $APIKEY" \ "https://api.dnsdb.info/dnsdb/v2/lookup/rrset/name/fsi.io?limit=10000"Wildcard Left Hand Side
Section titled “Wildcard Left Hand Side”Enumerate all subdomains of a second-level domain.
curl -s -H 'Accept: application/x-ndjson' -H "X-API-Key: $APIKEY" \ "https://api.dnsdb.info/dnsdb/v2/lookup/rrset/name/*.fsi.io?limit=10000"Wildcard Right Hand Side
Section titled “Wildcard Right Hand Side”Search for a base domain or TLD with a wildcard on the right.
curl -s -H 'Accept: application/x-ndjson' -H "X-API-Key: $APIKEY" \ "https://api.dnsdb.info/dnsdb/v2/lookup/rrset/name/example.*?limit=10000"IP → Names
Section titled “IP → Names”Return any names pointing to a specific IP.
curl -s -H 'Accept: application/x-ndjson' -H "X-API-Key: $APIKEY" \ "https://api.dnsdb.info/dnsdb/v2/lookup/rdata/ip/104.244.13.0,24?limit=10000"Name → Names
Section titled “Name → Names”Return any names pointing to a name (e.g., NS records).
curl -s -H 'Accept: application/x-ndjson' -H "X-API-Key: $APIKEY" \ "https://api.dnsdb.info/dnsdb/v2/lookup/rdata/name/ns1.infocity.club/NS?limit=10000"Considerations
Section titled “Considerations”- If you plan to truncate displayed answers, make a larger query to the API (limit ≥10,000) to get recent results.
- API data is not sorted. For investigations, sort by
time_lastto get the most recent records. - SOA records may contain email addresses—useful for pivoting into other data sources (e.g., historical WHOIS).
- In a UI, allow hyperlink pivoting between names and IPs for better UX.
- Enable filtering of DNS record types to parse results more easily.