Passive DNS history, ready for your own systems

At a glance

Authentication

Daily Downloads uses API tokens. Create one in the Spamhaus Customer Portal and send it in the Authorization header with every request:

Authorization: Bearer <your API token>

Daily Downloads accepts API tokens only, not single sign-on. Your account also needs Daily Downloads enabled. Every request needs a token: nothing is available without one.

What you can request

Dates are always written as YYYY-MM-DD in UTC, with leading zeros: 2026-09-01, not 2026-9-1.

Each file in a listing comes with its name, record type, the start of the four hours it covers, its size, when it was published and a ready-made download path. Use that path rather than building your own.

What's in a file

File names

Every file name follows the same pattern: pdns_<record type>_<date>_<start time>.json.gz. For example, pdns_A_20260916_0800.json.gz holds A records for the four hours starting 08:00 UTC on 16 September 2026.

Occasionally a second file is produced for the same four hours. It has a number added before the extension, such as pdns_NS_20260916_1600_2.json.gz. It holds additional records, not a replacement, so download both.

What a record looks like

{"rrname":"example.com","rrtype":1,"rdata":"192.0.2.10"}

Files can be large, so read them a line at a time rather than loading a whole file into memory.

Keep your copy up to date

1. Create an API token in the Spamhaus Customer Portal.
2. Check today's and yesterday's listings more often than every four hours, so you see each new file soon after it's published.
3. Compare each file's name and size with what you already hold. Because files never change, a name you already have is a file you already have.
4. Download any new file using the path from the listing.
5. If a download is interrupted, resume it from where it stopped rather than starting again. Most download tools can do this; for example, curl's -C - option.
6. Check the downloaded size against the size in the listing.
7. Read each file a line at a time and load the records into your own systems.

Good to know

• Everything is in UTC. Dates and four-hour periods follow UTC and don't change with daylight saving.
• Files arrive after their four hours end. A file is published a few minutes after the period it covers.
• Keep checking yesterday after midnight. Yesterday's last file arrives shortly after midnight UTC, so don't stop checking a date as soon as it changes.
• A day with nothing published yet is not an error. Its listing returns an empty list of files. Check the file count, not the response code.
• Files never change. You can keep them for as long as you need and never download the same file twice.
• The same record can appear in more than one file. That means it was seen again in a later period. Records are unique within a file; if you want unique records across files, remove repeats yourself.
• Don't ask for extra compression. Files are already compressed.
• Each download has a time limit. A very slow download can be closed before it finishes. Resume it rather than starting again.
• Older files may contain blank lines between records. Most tools skip them automatically. If yours doesn't, skip empty lines when reading.

Troubleshooting

Learn more

• Daily Downloads technical reference
• Real Time Streaming: new observations as they're seen
• API Reference

Want Daily Downloads for your team? Talk to us about access.