DNS Database Download of billions of DNS records | WhoisXML API

DNS Database Download: Gain access to the largest repository of active and passive DNS intelligence

Our DNS Database Download is an extensive resource covering billions of historical DNS records and close to 1 million weekly record additions.

The data feed files—which include A, AAAA, MX, NS, TXT, CNAME, SOA, and PTR records—are downloadable in CSV for easy follow-up analysis and integration into other system sources.

DNS Database Download
4.2 Billion+Domains and subdomains
Multi-billionDNS records
52,000+Satisfied customers
11+Years of data crawling

Benefits of our reverse DNS database

  • Comprehensive, coherent, and covering more TLDs than any other

    We offer the most recently updated domain database with every domain name linked to its IP address and host. Get downloads for all major gTLDs.

  • Get access to exhaustive and properly parsed data

    Obtain an up-to-date DNS database archive download as Comma Separated Values (.CSV) files to stay on top of the latest changes — suspicious or not — to DNS records.

  • Transform threat intelligence into actionable prevention and mitigation steps

    Manually parsing raw passive DNS data can be a tedious and error-prone job. With DNS Database Download, users can skip the legwork and readily turn feeds into effective defensive measures.

DNS Database | WhoisXML API

DNS Database Download can be configured to match your specific data access requirements

Take a look at our product sheet and contact us for pricing and other details.

Order database

What are the records tracked with our DNS Database Download service?

  • A&AAAA

    A and AAAA records help translate human-readable domain names or hostnames into machine-readable IP addresses, and so identify the specified resolutions between those IPs and domains.

  • MX

    MX records specify the mail server(s) that should receive emails for a domain name and the priority with which each server should be used.

  • NS

    NS records identify the DNS servers considered authoritative for their respective domain names and contain the associated DNS records.

  • TXT

    TXT records typically hold a domain’s descriptive text, generally giving human- and/or machine-readable information to help verify domain ownership and prevent spam.


    CNAME records indicate how web administrators have specified domain name aliases to point to their root or canonical domain names.

  • SOA

    SOA records contain important administrative information about a domain name’s zone and other details such as its administrator’s email address or the length of time for refreshes, retries, when to stop responding to zone queries, etc.

  • PTR

    PTR records are used for reverse DNS lookups and contain information on which domain name is matched with the IP address. They are opposite to A and AAAA records.

Practical usage

Threat hunting and defense

Threat hunting and defense

  • Track down suspicious cyber resources (hostnames, IP addresses, command-and-control [C&C] servers) and get the latest malware, phishing, or other threat information.
  • Detect patterns of malicious activity and identify phishing or other targeted attacks.
  • Discover associations among threat actors based on domain, IP, and DNS record associations to track and block their activity.
  • Conduct fact-based risk profile audits of domain names, IP addresses, and other digital assets.
  • Reveal all domains using the same host, DNS server, MX server or other infrastructure as an existing known malicious domain/threat actor aided by A, AAAA, MX, NS, TXT, CNAME, SOA, and PTR records.
  • Uncover all IPs a bad actor is using to hide malicious activity and avoid takedowns.
  • Conduct third-party audits of DNS/MX configurations.
  • Research fraudulent anomalous activities and get the intel and context needed to prevent them from reoccurring in the future.

Cybercrime investigation

Cybercriminals may use the same infrastructure resources and leave similar signatures and traces behind. DNS history allows you to follow those leads.

Cyber forensics analysis

Discover DNS record (A, AAAA, MX, NS, TXT, CNAME, SOA, and PTR) changes and see how threat incidents correlate. Accelerate incident response and post-breach analysis with context using current and historic domain and IP information.

Cybersecurity and anti-malware solution enhancement

Identify spam, dangerous websites, intrusions, and other web-related misbehavior.

SIEM and SOAR data enrichment

Obtain DNS intelligence for a variety of security information and event management (SIEM); security orchestration, automation, and response (SOAR); and threat intelligence (TI) platforms. Power next-generation firewalls (NGFWs) with better DNS intelligence data points. Identify and monitor Internet assets that can be traced back to entities operating in regions known for high geopolitical cyber risks.

Brand protection and market intelligence gathering

Brand protection and market intelligence gathering

  • Monitor your brand trademarks or copyrights and be notified of infringement when they are used on fraudulent domains.
  • Identify associations between hostnames and IP addresses, MX records, NS records and more.
  • Gain insights into domains.

Domain and IP reputation scoring system improvement

Establish domain/IP reputation standards based on facts and use them to reveal domains and IP addresses used by malicious actors.

Domain and IP reputation scoring system improvement

Domain Name System Primer

In this white paper, we give an overview of the Domain Name System, or DNS, one of the pillars of the Internet.

Read more

Request access to our passive DNS database

DNS Database Download | WhoisXML API

API integration available

Learn more about API integration