Spamhaus is delighted to announce the latest release of our Passive DNS service. This is a simple to use, effective and fast investigation tool, available via a Web Interface or API. With all the expected features of Passive DNS, including ‘Forward’ & ‘Reverse’ searches, we also have unique features including ‘Fuzzy’ search and International Domain Name (IDN) support. Want to find out more?…

Who should consider using Passive DNS?

Security Professionals, Malware Researchers, Brand Protection Specialists, Penetration Testers, among others.

Why use Passive DNS?

Spamhaus’ Passive DNS speeds up cyber research and investigations, providing you with increased visibility across the internet. By simply entering a single domain name or IP address, in addition to specific search parameters, you can quickly pivot to new areas of potential ‘badness,’ viewing real-time & historic Passive DNS data.

Watch out for our’ How to Use’ videos over the coming weeks to get a deeper understanding of how you can utilize this tool.

Features of Spamhaus’ Passive DNS

As with most Passive DNS tools, it is possible to run the following basic searches:

  • Forward search – on rrname queries (e.g.,
  • Reverse search – on rrdata queries (e.g., 123.456.7.89)

There are also a multitude of filters you can utilize to fine tune your search. In addition to the basic date and ‘Record Type’ filters, e.g., ‘A’ or ‘CNAME,’ we have several filters that are unique to Spamhaus: Word Search, Left Match, Fuzzy Search & IDN Support. Here’s a brief overview of some of the filters you can apply when running a query:

  • Exact match – Search for an exact match in the database of your requested query.
  • Right match – Perform a “right match” searching for the records which have the requested string on the rightmost side. (example: *
  • Left Match – Perform a “left match” searching for the records which have the requested string on the leftmost side. (example:*)
  • Word Match – Search for a single string in the target field
  • Last & First Seen Date – the dates you want the query to return results to and from.
  • Fuzzy search – Search for domains where one or multiple characters have been altered: Select the number of characters you want to be different from the original domain to reveal a host of spoofed domains.
  • IDN: Search for internationalized domain names once their “confusable” characters have been replaced with their normalized homoglyphs. e.g. “” is shown as “apþ“. For more information on this new function, click here.

Where does the data come from?

Spamhaus leverages Passive DNS data from The Spamhaus Project who have been providing threat intelligence to the industry for over 20 years. We also collect the data from trusted third parties across the globe. For a more in-depth look at Passive DNS data, click here.

How much does it cost?

If you have low usage requirements or are wanting to trial the product, you can get 200 queries per month for free (no credit card details requested). Should you require a more substantial plan, we won’t tie you into a contract; instead, we give you the flexibility to change your plan monthly to meet your ever-changing business requirements.


Register for your free account click here.

Related Products

Passive DNS

Our Passive DNS allows you to quickly and easily navigate through billions of DNS records to shine a spotlight on potentially malicious internet resources associated with your network or domain.

  • Reduce investigation times
  • Protect your online brand
  • Protect customers and end-users


Protecting your online brand with Passive DNS

23 September 2020


Discover how Passive DNS data can help brand specialists and marketing teams quickly identify potentially harmful domains.

Ways to use Passive DNS: Penetration Tester

13 August 2018


Passive DNS has the potential to assist various IT security roles, including Penetration Testers. Discover how this tool can help your investigations.

What is Passive DNS? A beginner’s guide

13 August 2018


Understand how Passive DNS is changing the way Security and Marketing professionals operate when it comes to identifying cyber threats and fraud.