Frequently
Asked
Questions

FAQs | Passive DNS

• How can the API receive the "First Seen" information from Passive DNS?

  “First Seen” information is not available, only “Last Seen”.

• How far back do you maintain historical data for Passive DNS?

  We have archive data going back to 2014, however the API accesses a live database that only retains one year’s worth of data.

• Is it possible to export all Passive DNS data recorded last year (2021) and deliver to our customer?

  Yes, we can provide historical data, but this is an additional cost. To find out about pricing, contact sales who will talk through your use case and share the best pricing.

• Is Passive DNS data GDPR compliant?

  Data received from subscribers contains no Personally Identifiable Information (PII) so there is no compromise of organizational, customer or employee data. All data is transported to Spamhaus with encryption in place.

  Passive DNS does not store which client (or person) made a query, just the fact that at some point in time, a domain has been associated with a specific DNS record. This ensures that privacy is maintained throughout the system.

• Using Passive DNS, is there a keyword query for the API?

  We do not support any special keyword queries. What you query is what gets queried in the database.

• What is Passive DNS data?

  It is a log of DNS queries and answers over time, recording the mappings between domain names and IP addresses. The data consists of anonymized DNS queries, collected from recursive DNS servers worldwide. It includes a number of different internet records including: IPs, domains, hosts, name servers, and canonical names. Using the Passive DNS Real Time Feed, you can uncover the connections between these records.

  You can learn more about where passive DNS data comes from in "What is Passive DNS? A beginner’s guide".

• What is the average daily record count for Passive DNS?

  Record counts vary considerably. The record count for the standard Passive DNS data is around 370 million deduped records. That total doesn’t include some derivative feeds such as the new domain feed, which we generally only make available as an add-on or special stand-alone product.

• What was the total number of records listed in 2021 for Passive DNS?

  We do not actively monitor this number. It is certainly in the billions – likely around 40+ billion.

• Where does Passive DNS data come from?

  We collect feeds from both our own systems and trusted partners, and we also perform targeted lookups. Every entry in our database represents an actual result from a live DNS server.

• Who can use Passive DNS via API?

  A wide range of roles can benefit from using the Passive DNS API including:

  • Security professionals: to investigate suspicious domains and uncover malicious infrastructure, or assist with incident response.
  • Malware Researchers: to track malicious domains, and reduce the need for complex reverse engineering when dealing with malware.
  • Brand Protection Specialists: to detect infringement of copyright and brands by detecting spoofed domains.