What is Passive DNS?
Before the introduction of passive DNS, there was no way to retrieve the content of any DNS zone owned by someone else. System administrators weren’t keen to share them. And once a DNS record change was made, the previous details were gone for good as the new version immediately propagated across the internet… Not much help if you need to find every domain a suspect IP address has resolved to historically, or vice versa. Passive DNS resolves this issue, turning DNS history into something you can pivot through on demand to find answers.
Where does Passive DNS data come from?
To understand where passive DNS data comes from, it helps to look at the basics of DNS. Passive DNS data is generated when a DNS lookup cannot be answered from cache and the hostname is resolved by an external authoritative server for resolution. When you visit www.example.com, if no one’s checked that website recently, the domain name has to be resolved through external DNS queries. Take a look at the infographic below:
With special probes activated on the DNS resolver, it’s possible to record the packets containing the answers to the client after the cache miss, along with the time and date stamp for when the query was made. That’s passive DNS data.
Does this data contain personally identifiable information (PII)?
No. All PII is held downstream. Passive DNS data doesn’t record which client or person made a query, only the fact that, at some point in time, a domain was associated with a specific DNS record. Here’s exactly what’s recorded:
- Domain name
- Record type
- Record value
- Time stamp
Privacy is maintained throughout. Importantly, passive DNS data captures the resolution event itself - not who made the request. No requestor IP addresses, user identities, or behavioural data are stored, meaning the dataset contains no personally identifiable information (PII).
Who uses passive DNS data and why?
Passive DNS data enhances existing threat intelligence, increasing visibility into potential threats. It delivers valuable insights for a range of roles, each using it for a different purpose, including:
- Security professionals, to investigate suspicious domains, identify malicious infrastructure, and speed up incident response.
- Malware researchers, to track malicious domains and reduce the reverse engineering required to understand a campaign. For example, a hostname’s IP address changing every 30 seconds - this is a classic indicator of malicious infrastructure that would require further investigation.
- Research Analysts, to understand how a particular domain name changes over time and how it is related to other domains and/or IP addresses, revealing patterns that could be identified by monitoring your own network alone.
- Brand protection specialists, to identify spoofed domains and websites, including how long they have been active, how they’re associated with other domains, and help build the full picture of a campaign.
Passive DNS data from Spamhaus
The data is collected globally from trusted third parties, including hosting companies, enterprises, and ISPs, alongside our own systems. Our passive DNS cluster handles hundreds of millions of DNS records per hour and stores hundreds of billions of records per month, providing you with access to a vast lake of threat intelligence data.
Introducing Deteqtive: passive DNS intelligence
Until now, that data has been accessed through our Passive DNS API or pulled from the Passive DNS Real-Time Feed. Now it also powers Deteqtive, a passive DNS intelligence platform.
-
Search, and pivot: move effortlessly between domains and IP addresses, including every IP a domain has used, and every domain that's pointed to a given IP or CIDR.
-
Pattern matching: run fuzzy or exact matching searches to surface campaigns, not just individual records, turning one lookalike domain into the full picture.
-
API-first and built for AI agents: access the same data in the UI, via REST API, NDJSON bulk export, and over MCP for AI agents.
Deteqtive is currently in early access - learn more here or get in touch if you have any questions.