Chronicle database

Samples

Explore sample files from the Chronicle database.

A records dns-database-2k-sample.csv CSV A records (.com, .net, .org) dns-database-2k-sample-com-net-org.csv CSV AAAA records dns-aaaa-database-2k-sample.csv CSV MX records dns-mx-database-2k-sample.csv CSV NS records dns-ns-database-2k-sample.csv CSV TXT records dns-txt-database-2k-sample.csv CSV CNAME records dns-cname-database-2k-sample.csv CSV SOA records dns-soa-database-2k-sample.csv CSV PTR records dns-ptr-database-2k-sample.csv CSV

Sample vs Full Dataset

Samples contain up to 2,000 records. Full datasets include billions of historical records with real-time updates and advanced filtering.

Talk to our team

The database includes A, AAAA, MX, NS, TXT, CNAME, SOA, and PTR records, and can be downloaded in CSV.

Subscription type	Description
Daily incremental updates	Changes in DNS records from the last day. Files are in the following format, in the daily_datafeed subdirectory: - "daily_datafeed/dns_database.%DATE%.daily.csv.gz" - "daily_datafeed/dns_aaaa_database.%DATE%.daily.csv.gz" - "daily_datafeed/dns_mx_database.%DATE%.daily.csv.gz" - "daily_datafeed/dns_ns_database.%DATE%.daily.csv.gz", - "daily_datafeed/dns_txt_database.%DATE%.daily.csv.gz", - "daily_datafeed/dns_cname_database.%DATE%.daily.csv.gz", - "daily_datafeed/dns_soa_database.%DATE%.daily.csv.gz", - "daily_datafeed/dns_ptr_database.%DATE%.daily.csv.gz", e.g. "daily_datafeed/dns_database.2021-12-01.daily.csv.gz".
Weekly incremental updates	Changes in DNS records from the last week. Files are in the following format: - "dns_database.%DATE%.weekly.diff.csv.gz" - "dns_aaaa_database.%DATE%.weekly.diff.csv.gz" - "dns_mx_database.%DATE%.weekly.diff.csv.gz", - "dns_ns_database.%DATE%.weekly.diff.csv.gz", - "dns_txt_database.%DATE%.weekly.diff.csv.gz", - "dns_cname_database.%DATE%.weekly.diff.csv.gz", - "dns_soa_database.%DATE%.weekly.diff.csv.gz", - "dns_ptr_database.%DATE%.weekly.diff.csv.gz", e.g. "dns_database.2021-12-01.weekly.diff.csv.gz". The weekly DNS database is released on Tuesdays.
Monthly incremental updates	Changes in DNS records from the last month. Files are in the following format: - "dns_database.%DATE%.monthly.diff.csv.gz" - "dns_aaaa_database.%DATE%.monthly.diff.csv.gz" - "dns_mx_database.%DATE%.monthly.diff.csv.gz", - "dns_ns_database.%DATE%.monthly.diff.csv.gz", - "dns_txt_database.%DATE%.monthly.diff.csv.gz", - "dns_cname_database.%DATE%.monthly.diff.csv.gz", - "dns_soa_database.%DATE%.monthly.diff.csv.gz", - "dns_ptr_database.%DATE%.monthly.diff.csv.gz", e.g. "dns_database.2021-12-01.monthly.diff.csv.gz". The monthly DNS database build begins on the first Monday of each month and is typically released on Tuesdays. However, in some cases, building can take several days.
Weekly full updates	Full DNS records from the last ninety days. Files are in the following format: - "dns_database.%DATE%.full.csv.gz" - "dns_aaaa_database.%DATE%.full.csv.gz" - "dns_mx_database.%DATE%.full.csv.gz" - "dns_ns_database.%DATE%.full.csv.gz", - "dns_txt_database.%DATE%.full.csv.gz", - "dns_cname_database.%DATE%.full.csv.gz", - "dns_soa_database.%DATE%.full.csv.gz", - "dns_ptr_database.%DATE%.full.csv.gz", e.g. "dns_database.2021-12-01.full.csv.gz".
Lite database	A partial database of DNS records for a given date made for academic purposes. It includes about 5% of a weekly full database. These files are named in format: - "dns_database.%DATE%.academic.csv.gz" - "dns_aaaa_database.%DATE%.academic.csv.gz" - "dns_mx_database.%DATE%.academic.csv.gz" - "dns_ns_database.%DATE%.academic.csv.gz" - "dns_txt_database.%DATE%.academic.csv.gz" - "dns_cname_database.%DATE%.academic.csv.gz" - "dns_soa_database.%DATE%.academic.csv.gz" - "dns_ptr_database.%DATE%.academic.csv.gz" e.g. "dns_database.2021-12-01.academic.csv.gz".

Note that the weekly and monthly data are derived from the concatenation of the respective daily data and the addition of the first field, the date.

How to download the datafeed files

Recommended decompression tool

When working with large compressed files, we recommend using unpigz rather than gunzip. Based on our performance tests, gunzip can be almost 2x slower than unpigz for large files. For this reason, unpigz is the preferred decompression tool.

Downloading via FTP

Host: datafeeds.whoisxmlapi.com
Port: 21210
Username: 'user'
Password: equal to your personal API Key which you can obtain from the My Products page.
Base path: ftp://datafeeds.whoisxmlapi.com:21210
Folder: DNS_Database_Download

When dealing with extensive data sets, factors such as download speed, round-trip times, network stability, and disk I/O can influence the successful completion of your download over the HTTP protocol. Additionally, external elements like antivirus software may introduce complexities that hinder the seamless transfer of your data. To ensure a smoother and more reliable download experience, we highly recommend utilizing the FTP (File Transfer Protocol) option whenever possible. FTP provides a robust solution that minimizes the impact of potential challenges associated with HTTP downloads. If you encounter download errors or face any difficulties, we encourage you to reach out to our dedicated support department. They will be more than happy to assist you in enabling FTP access, thereby optimizing your data transfer process.

Downloading via HTTPS

Base path: https://download.whoisxmlapi.com/datafeeds/
Username and password: equal to your personal API Key which you can obtain from the My Products page.
Folder: DNS_Database_Download

Downloading via FTPS

Read more about the FTPS connection: https://en.wikipedia.org/wiki/FTPS.

Our FTP server supports explicit FTP over TLS encryption. You may configure your FTP client to use explicit FTP over TLS encryption for secure communications.

Our FTPS server is accessed using the same paths and API keys as a regular FTP server, the instructions for which are described above. To connect via FTPS, select the "Require explicit FTP over TLS" encryption option in your FTP client, if it supports it. FileZilla configuration example:

Average file sizes

Measured as of 23 September 2025.

A files

File content	Filename suffix	Avg. gzipped file size	Avg. unpacked file size	Avg. number of records
Daily incremental updates	.daily	2.6GB	12GB	333M
Weekly incremental updates	.weekly.diff	4.5GB	19GB	452M
Monthly incremental updates	.monthly.diff	35GB	161GB	4.4B
Weekly full database	.full	201GB	942GB	28B
Weekly full database for academia	.academic	12GB	48GB	1.4B

MX files

File content	Filename suffix	Avg. gzipped file size	Avg. unpacked file size	Avg. number of records
Daily incremental updates	.daily	236MB	1.5GB	20M
Weekly incremental updates	.weekly.diff	501MB	2.9GB	41M
Monthly incremental updates	.monthly.diff	2.5GB	17GB	202M
Weekly full database	.full	17GB	116GB	1.5B
Weekly full database for academia	.academic	949MB	5.8GB	75M

NS files

File content	Filename suffix	Avg. gzipped file size	Avg. unpacked file size	Avg. number of records
Daily incremental updates	.daily	345MB	2.3GB	37M
Weekly incremental updates	.weekly.diff	845MB	5.7GB	90M
Monthly incremental updates	.monthly.diff	3.6GB	26GB	364M
Weekly full database	.full	30GB	237GB	3.4B
Weekly full database for academia	.academic	1.7GB	12GB	169M

TXT files

File content	Filename suffix	Avg. gzipped file size	Avg. unpacked file size	Avg. number of records
Daily incremental updates	.daily	425MB	2.2GB	23M
Weekly incremental updates	.weekly.diff	825MB	4.1GB	45M
Monthly incremental updates	.monthly.diff	4.8GB	30GB	285M
Weekly full database	.full	36GB	215GB	2.1B
Weekly full database for academia	.academic	2.0GB	11GB	101M

CNAME files

File content	Filename suffix	Avg. gzipped file size	Avg. unpacked file size	Avg. number of records
Daily incremental updates	.daily	800MB	3.9GB	46M
Weekly incremental updates	.weekly.diff	1.3GB	7.9GB	92M
Monthly incremental updates	.monthly.diff	11GB	56GB	649M
Weekly full database	.full	52GB	263GB	3.1B
Weekly full database for academia	.academic	2.9GB	14GB	155M

SOA files

File content	Filename suffix	Avg. gzipped file size	Avg. unpacked file size	Avg. number of records
Daily incremental updates	.daily	314MB	1.8GB	15M
Weekly incremental updates	.weekly.diff	1.2GB	6.5GB	56M
Monthly incremental updates	.monthly.diff	4.2GB	25GB	206M
Weekly full database	.full	26GB	153GB	1.3B
Weekly full database for academia	.academic	1.4GB	7.7GB	62M

AAAA files

File content	Filename suffix	Avg. gzipped file size	Avg. unpacked file size	Avg. number of records
Daily incremental updates	.daily	977MB	5.5GB	126M
Weekly incremental updates	.weekly.diff	1.7GB	9.3GB	177M
Monthly incremental updates	.monthly.diff	14GB	79GB	1.8B
Weekly full database	.full	78GB	460GB	11B
Weekly full database for academia	.academic	4.2GB	23GB	534M

PTR files

File content	Filename suffix	Avg. gzipped file size	Avg. unpacked file size	Avg. number of records
Daily incremental updates	.daily	6.7MB	27MB	495K
Weekly incremental updates	.weekly.diff	5.6MB	22MB	369K
Monthly incremental updates	.monthly.diff	12MB	50MB	811K
Weekly full database	.full	108MB	466MB	8.2M
Weekly full database for academia	.academic	6.0MB	22MB	385K

CSV output structure and fields' descriptions

The database files are comma-separated value-files without text delimiters. The files use DOS/Windows - style line terminators (CR+LF). The first line is a header line with the field names. Each line has four or five fields depending on the subscription type:

A files

Columns: d,du,ips,wildcard,active
Example: 0--r.nom.za,1727012161,127.0.0.1,,true

d	Domain or subdomain name.
du	UNIX timestamp of the last visit/update on current record. If there is more than one IP address, the timestamp corresponds to all of them.
ips	List of IPs associated with the domain, separated by space.
wildcard	The wildcard field indicates whether the DNS record is part of a wildcard entry. To determine this: We replace the last domain level with a random string, creating a new Fully Qualified Domain Name (FQDN) as a subdomain. We then query the nameserver for this newly generated FQDN. If the nameserver returns a DNS record for this random subdomain, the original domain is marked as a wildcard entry. If the field is true, it means: The domain has a wildcard DNS configuration (e.g., .example.com). Any subdomain of the form sub.example.com will resolve to a valid DNS record, as the wildcard () catches all subdomains not explicitly defined. If the field is false, it means: Only explicitly defined subdomains will have corresponding DNS records. A query for a random subdomain (e.g., sub.example.com) will not resolve to a valid DNS record unless it has been specifically configured. If the field is empty, it means that we have not yet checked the DNS record for this domain. Possible values: true \| false
active	The active field shows whether a DNS record exists for the given domain. The check works as follows: The FQDN is queried multiple times against the DNS server. If a valid DNS record is returned, the domain is marked as active. If the DNS server returns an error or no record is found during these queries, the domain is marked as not active. If the field is true, it means: The DNS record was successfully retrieved. The domain's DNS resolution was successful. If the field is false, it means: The DNS record could not be retrieved. The domain's DNS resolution was unsuccessful during our attempts. If the field is empty, it means that we have not yet checked the DNS record for this domain. Possible values: true \| false

AAAA files

Columns: d,du,ips,wildcard,active
Example: 0--f.blogspot.hr,1726563076,2607:f8b0:4006:81f::2001,,true

d	Domain or subdomain name.
du	UNIX timestamp of the last visit/update on current record. If there is more than one IP address, the timestamp corresponds to all of them.
ips	List of IPs associated with the domain, separated by space.
wildcard	The wildcard field indicates whether the DNS record is part of a wildcard entry. To determine this: We replace the last domain level with a random string, creating a new Fully Qualified Domain Name (FQDN) as a subdomain. We then query the nameserver for this newly generated FQDN. If the nameserver returns a DNS record for this random subdomain, the original domain is marked as a wildcard entry. If the field is true, it means: The domain has a wildcard DNS configuration (e.g., .example.com). Any subdomain of the form sub.example.com will resolve to a valid DNS record, as the wildcard () catches all subdomains not explicitly defined. If the field is false, it means: Only explicitly defined subdomains will have corresponding DNS records. A query for a random subdomain (e.g., sub.example.com) will not resolve to a valid DNS record unless it has been specifically configured. If the field is empty, it means that we have not yet checked the DNS record for this domain. Possible values: true \| false
active	The active field shows whether a DNS record exists for the given domain. The check works as follows: The FQDN is queried multiple times against the DNS server. If a valid DNS record is returned, the domain is marked as active. If the DNS server returns an error or no record is found during these queries, the domain is marked as not active. If the field is true, it means: The DNS record was successfully retrieved. The domain's DNS resolution was successful. If the field is false, it means: The DNS record could not be retrieved. The domain's DNS resolution was unsuccessful during our attempts. If the field is empty, it means that we have not yet checked the DNS record for this domain. Possible values: true \| false

MX files

Columns: d,du,pr,mx,wildcard,active
Example: 0-0.im,1725900527,65,route1.mx.cloudflare.net,,true
Notice: One domain can have multiple MX records. In that case, next lines will have the same domain name and different MX records.

d	Domain or subdomain name.
du	UNIX timestamp of the last visit/update on current record.
pr	Priority identifies which mailserver should be preferred.
mx	The MX record associated with the domain.
wildcard	The wildcard field indicates whether the DNS record is part of a wildcard entry. To determine this: We replace the last domain level with a random string, creating a new Fully Qualified Domain Name (FQDN) as a subdomain. We then query the nameserver for this newly generated FQDN. If the nameserver returns a DNS record for this random subdomain, the original domain is marked as a wildcard entry. If the field is true, it means: The domain has a wildcard DNS configuration (e.g., .example.com). Any subdomain of the form sub.example.com will resolve to a valid DNS record, as the wildcard () catches all subdomains not explicitly defined. If the field is false, it means: Only explicitly defined subdomains will have corresponding DNS records. A query for a random subdomain (e.g., sub.example.com) will not resolve to a valid DNS record unless it has been specifically configured. If the field is empty, it means that we have not yet checked the DNS record for this domain. Possible values: true \| false
active	The active field shows whether a DNS record exists for the given domain. The check works as follows: The FQDN is queried multiple times against the DNS server. If a valid DNS record is returned, the domain is marked as active. If the DNS server returns an error or no record is found during these queries, the domain is marked as not active. If the field is true, it means: The DNS record was successfully retrieved. The domain's DNS resolution was successful. If the field is false, it means: The DNS record could not be retrieved. The domain's DNS resolution was unsuccessful during our attempts. If the field is empty, it means that we have not yet checked the DNS record for this domain. Possible values: true \| false

NS files

Columns: d,du,ns,wildcard,active
Example: 0--1.net,1725227715,dns02.muumuu-domain.com,,true
Notice: One domain can have multiple NS records. In that case, next lines will have the same domain name and different NS records.

d	Domain or subdomain name.
du	UNIX timestamp of the last visit/update on current record.
ns	The NS record associated with the domain.
wildcard	The wildcard field indicates whether the DNS record is part of a wildcard entry. To determine this: We replace the last domain level with a random string, creating a new Fully Qualified Domain Name (FQDN) as a subdomain. We then query the nameserver for this newly generated FQDN. If the nameserver returns a DNS record for this random subdomain, the original domain is marked as a wildcard entry. If the field is true, it means: The domain has a wildcard DNS configuration (e.g., .example.com). Any subdomain of the form sub.example.com will resolve to a valid DNS record, as the wildcard () catches all subdomains not explicitly defined. If the field is false, it means: Only explicitly defined subdomains will have corresponding DNS records. A query for a random subdomain (e.g., sub.example.com) will not resolve to a valid DNS record unless it has been specifically configured. If the field is empty, it means that we have not yet checked the DNS record for this domain. Possible values: true \| false
active	The active field shows whether a DNS record exists for the given domain. The check works as follows: The FQDN is queried multiple times against the DNS server. If a valid DNS record is returned, the domain is marked as active. If the DNS server returns an error or no record is found during these queries, the domain is marked as not active. If the field is true, it means: The DNS record was successfully retrieved. The domain's DNS resolution was successful. If the field is false, it means: The DNS record could not be retrieved. The domain's DNS resolution was unsuccessful during our attempts. If the field is empty, it means that we have not yet checked the DNS record for this domain. Possible values: true \| false

TXT files

Columns: d,du,txt,wildcard,active
Example: 0--1.net,1725227715,v=spf1 include:_spf.heteml.jp ~all,,true
Notice: One domain can have multiple TXT records. In that case, next lines will have the same domain name and different TXT records.

d	Domain or subdomain name.
du	UNIX timestamp of the last visit/update on current record.
txt	The TXT record associated with the domain.
wildcard	The wildcard field indicates whether the DNS record is part of a wildcard entry. To determine this: We replace the last domain level with a random string, creating a new Fully Qualified Domain Name (FQDN) as a subdomain. We then query the nameserver for this newly generated FQDN. If the nameserver returns a DNS record for this random subdomain, the original domain is marked as a wildcard entry. If the field is true, it means: The domain has a wildcard DNS configuration (e.g., .example.com). Any subdomain of the form sub.example.com will resolve to a valid DNS record, as the wildcard () catches all subdomains not explicitly defined. If the field is false, it means: Only explicitly defined subdomains will have corresponding DNS records. A query for a random subdomain (e.g., sub.example.com) will not resolve to a valid DNS record unless it has been specifically configured. If the field is empty, it means that we have not yet checked the DNS record for this domain. Possible values: true \| false
active	The active field shows whether a DNS record exists for the given domain. The check works as follows: The FQDN is queried multiple times against the DNS server. If a valid DNS record is returned, the domain is marked as active. If the DNS server returns an error or no record is found during these queries, the domain is marked as not active. If the field is true, it means: The DNS record was successfully retrieved. The domain's DNS resolution was successful. If the field is false, it means: The DNS record could not be retrieved. The domain's DNS resolution was unsuccessful during our attempts. If the field is empty, it means that we have not yet checked the DNS record for this domain. Possible values: true \| false

CNAME files

Columns: d,du,cname,wildcard,active
Example: 0--6.hb.cldmail.ru,1724661484,hb.cldmail.ru,,true
Notice: One domain can have multiple CNAME records. In that case, next lines will have the same domain name and different CNAME records.

d	Domain or subdomain name.
du	UNIX timestamp of the last visit/update on current record.
cname	The CNAME record associated with the domain.
wildcard	The wildcard field indicates whether the DNS record is part of a wildcard entry. To determine this: We replace the last domain level with a random string, creating a new Fully Qualified Domain Name (FQDN) as a subdomain. We then query the nameserver for this newly generated FQDN. If the nameserver returns a DNS record for this random subdomain, the original domain is marked as a wildcard entry. If the field is true, it means: The domain has a wildcard DNS configuration (e.g., .example.com). Any subdomain of the form sub.example.com will resolve to a valid DNS record, as the wildcard () catches all subdomains not explicitly defined. If the field is false, it means: Only explicitly defined subdomains will have corresponding DNS records. A query for a random subdomain (e.g., sub.example.com) will not resolve to a valid DNS record unless it has been specifically configured. If the field is empty, it means that we have not yet checked the DNS record for this domain. Possible values: true \| false
active	The active field shows whether a DNS record exists for the given domain. The check works as follows: The FQDN is queried multiple times against the DNS server. If a valid DNS record is returned, the domain is marked as active. If the DNS server returns an error or no record is found during these queries, the domain is marked as not active. If the field is true, it means: The DNS record was successfully retrieved. The domain's DNS resolution was successful. If the field is false, it means: The DNS record could not be retrieved. The domain's DNS resolution was unsuccessful during our attempts. If the field is empty, it means that we have not yet checked the DNS record for this domain. Possible values: true \| false

SOA files

Columns: d,du,soa,wildcard,active
Example: 0--1.net,1725227715,dns01.muumuu-domain.com. postmaster.0--1.net. 1724718394 3600 1800 604800 3600,,true
Notice: One domain can have multiple SOA records. In that case, next lines will have the same domain name and different SOA records.

d	Domain or subdomain name.
du	UNIX timestamp of the last visit/update on current record.
soa	The SOA record associated with the domain.
wildcard	The wildcard field indicates whether the DNS record is part of a wildcard entry. To determine this: We replace the last domain level with a random string, creating a new Fully Qualified Domain Name (FQDN) as a subdomain. We then query the nameserver for this newly generated FQDN. If the nameserver returns a DNS record for this random subdomain, the original domain is marked as a wildcard entry. If the field is true, it means: The domain has a wildcard DNS configuration (e.g., .example.com). Any subdomain of the form sub.example.com will resolve to a valid DNS record, as the wildcard () catches all subdomains not explicitly defined. If the field is false, it means: Only explicitly defined subdomains will have corresponding DNS records. A query for a random subdomain (e.g., sub.example.com) will not resolve to a valid DNS record unless it has been specifically configured. If the field is empty, it means that we have not yet checked the DNS record for this domain. Possible values: true \| false
active	The active field shows whether a DNS record exists for the given domain. The check works as follows: The FQDN is queried multiple times against the DNS server. If a valid DNS record is returned, the domain is marked as active. If the DNS server returns an error or no record is found during these queries, the domain is marked as not active. If the field is true, it means: The DNS record was successfully retrieved. The domain's DNS resolution was successful. If the field is false, it means: The DNS record could not be retrieved. The domain's DNS resolution was unsuccessful during our attempts. If the field is empty, it means that we have not yet checked the DNS record for this domain. Possible values: true \| false

PTR files

Columns: ip,du,ptr,wildcard,active
Example: 1.0.100.10,1723329288,10.100.0.1.megaegg.ne.jp,,
Notice: One IP can have multiple PTR records. In that case, next lines will have the same IP address and different PTR records.

ip	IP address.
du	UNIX timestamp of the last visit/update on current record.
ptr	The PTR record associated with the IP.
wildcard	PTR files datafeed contains a wildcard field for parsing compatibility, it's always empty.
active	The active field shows whether a DNS record exists for the given domain. The check works as follows: The FQDN is queried multiple times against the DNS server. If a valid DNS record is returned, the domain is marked as active. If the DNS server returns an error or no record is found during these queries, the domain is marked as not active. If the field is true, it means: The DNS record was successfully retrieved. The domain's DNS resolution was successful. If the field is false, it means: The DNS record could not be retrieved. The domain's DNS resolution was unsuccessful during our attempts. If the field is empty, it means that we have not yet checked the DNS record for this domain. Possible values: true \| false

WHOIS / WHOIS History

DNS / DNS History

IP Geolocation / IP Netblocks

Domain/WHOIS

DNS/IP

Intelligence

Other

Domain/WHOIS

DNS/IP

Intelligence

Other

Domain/WHOIS

DNS/IP

Intelligence

Other

Research

Monitoring

White-Label

Chronicle database

Samples

Sample vs Full Dataset

The database includes A, AAAA, MX, NS, TXT, CNAME, SOA, and PTR records, and can be downloaded in CSV.

How to download the datafeed files

Recommended decompression tool

Downloading via FTP

Downloading via HTTPS

Downloading via FTPS

Average file sizes

A files

MX files

NS files

TXT files

CNAME files

SOA files

AAAA files

PTR files

CSV output structure and fields' descriptions

A files

AAAA files

MX files

NS files

TXT files

CNAME files

SOA files

PTR files

Have questions?