Standard database | Specifications | DNS Database Download | WhoisXML API
Products APIs Data Feeds Web Tools Domain Research & Monitoring Enterprise Packages
WHOIS / WHOIS History
WHOIS / WHOIS History

Provide current and historical ownership information on domains / IPs. Identify all connections between domains, registrants, registrars, and DNS servers.

DNS / DNS History
DNS / DNS History

Look into all current and historical DNS / IP connections between domains and A, MX, NS, and other records. Monitor suspicious changes to DNS records.

IP Geolocation / IP Netblocks
IP Geolocation / IP Netblocks

Get detailed context on an IP address, including its user’s geolocation, time zone, connected domains, connection type, IP range, ASN, and other network ownership details.

Domain Research Suite (DRS)
Domain Research Suite (DRS)

Access our web-based solution to dig into and monitor all domain events of interest.

Domain Research Suite (DRS)
Domain Research Suite (DRS)

Get access to a web-based enterprise-grade solution to search and monitor domain registrations and ownership details for branded terms, fuzzy matches, registrants of interest, and more.

Research
Monitoring
White-Label
Predictive Threat Intelligence Feeds
Predictive Threat Intelligence Feeds

Predictive threat intelligence is your best first line of defense. Subscribe to the feeds to strengthen your cybersecurity posture. Contact us today for more information.

WhoisXML API Internet Infrastructure
Internet Infrastructure

Unlock integrated intelligence on Internet properties and their ownership, infrastructure, and other attributes.

Enterprise API Packages
Enterprise API Packages

Our complete set of domain, IP, and DNS intelligence available via API calls as an annual subscription with predictable pricing.

Security Intelligence (SI) Suite
Security Intelligence (SI) Suite

Offers complete access to WHOIS, IP, DNS, and subdomain data for product enrichment, threat hunting and more.

Multi-Level API User Administration Now Available - Manage individual API keys for team members in your organization.

Learn More
×
Contact Us
Specifications Pricing Blog
FAQ - Premium database - Standard database

Standard database

Samples

The database comes in five forms, which include A, AAAA, MX, NS, TXT, CNAME, SOA, and PTR records and can be downloaded in CSV. The Standard DNS Database offers current DNS records.

Subscription type Description
Daily updates Include DNS records (A, AAAA, MX, NS, TXT, CNAME, SOA, PTR) that have been added during a previous day for a given date in unified and consistent CSV format. These files are located in the daily_datafeed subdirectory and are named in format:
- "daily_datafeed/dns_database.%DATE%.daily.csv.gz"
- "daily_datafeed/dns_aaaa_database.%DATE%.daily.csv.gz"
- "daily_datafeed/dns_mx_database.%DATE%.daily.csv.gz"
- "daily_datafeed/dns_ns_database.%DATE%.daily.csv.gz",
- "daily_datafeed/dns_txt_database.%DATE%.daily.csv.gz",
- "daily_datafeed/dns_cname_database.%DATE%.daily.csv.gz",
- "daily_datafeed/dns_soa_database.%DATE%.daily.csv.gz",
- "daily_datafeed/dns_ptr_database.%DATE%.daily.csv.gz",
e.g. "daily_datafeed/dns_database.2021-12-01.daily.csv.gz".
Weekly updates Include changes in the weekly full database of DNS records compared to the previous period. Includes added, dropped, and modified records since the previous week. These files are named in format:
- "dns_database.%DATE%.weekly.diff.csv.gz"
- "dns_aaaa_database.%DATE%.weekly.diff.csv.gz"
- "dns_mx_database.%DATE%.weekly.diff.csv.gz",
- "dns_ns_database.%DATE%.weekly.diff.csv.gz",
- "dns_txt_database.%DATE%.weekly.diff.csv.gz",
- "dns_cname_database.%DATE%.weekly.diff.csv.gz",
- "dns_soa_database.%DATE%.weekly.diff.csv.gz",
- "dns_ptr_database.%DATE%.weekly.diff.csv.gz",
e.g. "dns_database.2021-12-01.weekly.diff.csv.gz".
Monthly updates Include changes in the monthly full database of DNS records compared to the previous period. Includes added, dropped, and modified records since the previous month. These files are named in format:
- "dns_database.%DATE%.monthly.diff.csv.gz"
- "dns_aaaa_database.%DATE%.monthly.diff.csv.gz"
- "dns_mx_database.%DATE%.monthly.diff.csv.gz",
- "dns_ns_database.%DATE%.monthly.diff.csv.gz",
- "dns_txt_database.%DATE%.monthly.diff.csv.gz",
- "dns_cname_database.%DATE%.monthly.diff.csv.gz",
- "dns_soa_database.%DATE%.monthly.diff.csv.gz",
- "dns_ptr_database.%DATE%.monthly.diff.csv.gz",
e.g. "dns_database.2021-12-01.monthly.diff.csv.gz".
Weekly Full database A weekly full database of DNS records (A, AAAA, MX, NS, TXT, CNAME, SOA, PTR) collected for the previous 90 days before a given date in a unified and consistent CSV format. These files are named in format:
- "dns_database.%DATE%.full.csv.gz"
- "dns_aaaa_database.%DATE%.full.csv.gz"
- "dns_mx_database.%DATE%.full.csv.gz"
- "dns_ns_database.%DATE%.full.csv.gz",
- "dns_txt_database.%DATE%.full.csv.gz",
- "dns_cname_database.%DATE%.full.csv.gz",
- "dns_soa_database.%DATE%.full.csv.gz",
- "dns_ptr_database.%DATE%.full.csv.gz",
e.g. "dns_database.2021-12-01.full.csv.gz".
Lite database A partial database of A DNS records for a given date made for academic purposes. It includes about 5% of a weekly full database. These files are named in format:
- "dns_database.%DATE%.academic.csv.gz"
e.g. "dns_database.2021-12-01.academic.csv.gz".


Note that the weekly and monthly data are derived from the concatenation of the respective daily data and the addition of the first field, the date.

Downloading via FTP

When dealing with extensive data sets, factors such as download speed, round-trip times, network stability, and disk I/O can influence the successful completion of your download over the HTTP protocol. Additionally, external elements like antivirus software may introduce complexities that hinder the seamless transfer of your data. To ensure a smoother and more reliable download experience, we highly recommend utilizing the FTP (File Transfer Protocol) option whenever possible. FTP provides a robust solution that minimizes the impact of potential challenges associated with HTTP downloads. If you encounter download errors or face any difficulties, we encourage you to reach out to our dedicated support department. They will be more than happy to assist you in enabling FTP access, thereby optimizing your data transfer process.

Downloading via HTTPS

Downloading via FTPS

Read more about the FTPS connection: https://en.wikipedia.org/wiki/FTPS.

Our FTP server supports explicit FTP over TLS encryption. You may configure your FTP client to use explicit FTP over TLS encryption for secure communications.

Our FTPS server is accessed using the same paths and API keys as a regular FTP server, the instructions for which are described above. To connect via FTPS, select the "Require explicit FTP over TLS" encryption option in your FTP client, if it supports it. FileZilla configuration example:

explicit FTP over TLS encryption

Average file sizes

Measured as of 18 October 2024.

A files

File content Filename suffix Avg. gzipped file size Avg. unpacked file size Avg. number of records
Partial database for academic purposes .academic 852.1MB 3.4GB 71.4M
Weekly full database export .full 14.3GB 68.4GB 1.4B
Weekly changes in the full database .weekly.diff 436.3MB 1.7GB 39.7M
Monthly changes in the full database .monthly.diff 2.2GB 8.7GB 204M
Records added during the previous day .daily 134.2MB 512.8MB 12.7M

MX files

File content Filename suffix Avg. gzipped file size Avg. unpacked file size Avg. number of records
Weekly full database export .full 4.1GB 23.9GB 417.9M
Weekly changes in the full database .weekly.diff 65.9MB 383MB 6.1M
Monthly changes in the full database .monthly.diff 370.3MB 2.1GB 34.8M
Records added during the previous day .daily 53.4MB 331.3MB 5.5M

NS files

File content Filename suffix Avg. gzipped file size Avg. unpacked file size Avg. number of records
Weekly full database export .full 7.5GB 47.6GB 0.9B
Weekly changes in the full database .weekly.diff 113.4MB 675MB 12.7M
Monthly changes in the full database .monthly.diff 656.6MB 4.1GB 78.9M
Records added during the previous day .daily 97.1MB 631MB 11.8M

TXT files

File content Filename suffix Avg. gzipped file size Avg. unpacked file size Avg. number of records
Weekly full database export .full 5.8GB 21.8GB 278M
Weekly changes in the full database .weekly.diff 117.1MB 445.5MB 5.5M
Monthly changes in the full database .monthly.diff 677.8MB 3.0GB 36.2M
Records added during the previous day .daily 79.8MB 287.7MB 3.5M

CNAME files

File content Filename suffix Avg. gzipped file size Avg. unpacked file size Avg. number of records
Weekly full database export .full 1.3GB 5.7GB 74.2M
Weekly changes in the full database .weekly.diff 143.3MB 692.0MB 7.9M
Monthly changes in the full database .monthly.diff 671.9MB 3.2GB 36.9M
Records added during the previous day .daily 25.2MB 122.0MB 1.5M

SOA files

File content Filename suffix Avg. gzipped file size Avg. unpacked file size Avg. number of records
Weekly full database export .full 7.9GB 39.9GB 371.4M
Weekly changes in the full database .weekly.diff 225.1MB 1.1GB 10.1M
Monthly changes in the full database .monthly.diff 1.2GB 6.0GB 55.5M
Records added during the previous day .daily 103.1MB 512.4MB 4.7M

AAAA files

File content Filename suffix Avg. gzipped file size Avg. unpacked file size Avg. number of records
Weekly full database export .full 1.8GB 7.3GB 151.5M
Weekly changes in the full database .weekly.diff 65.5MB 267.0MB 5.1M
Monthly changes in the full database .monthly.diff 354.1MB 1.5GB 28.9M
Records added during the previous day .daily 20.6MB 79.2MB 1.6M

PTR files

File content Filename suffix Avg. gzipped file size Avg. unpacked file size Avg. number of records
Weekly full database export .full 4.5GB 29.6GB 479M
Weekly changes in the full database .weekly.diff 23.2MB 117MB 1.9M
Monthly changes in the full database .monthly.diff 120.1MB 648.1MB 10.5M
Records added during the previous day .daily 11.7MB 49.0MB 862.8K

CSV output structure and fields' descriptions

The database files are comma-separated value-files without text delimiters. The files use DOS/Windows - style line terminators (CR+LF). The first line is a header line with the field names. Each line has four or five fields depending on the subscription type:

A files

  • Columns: d,du,ips,wildcard,active
  • Example: 0--r.nom.za,1727012161,127.0.0.1,,true
d
Domain or subdomain name.
du
UNIX timestamp of the last visit/update on current record. If there is more than one IP address, the timestamp corresponds to all of them.
ips
List of IPs associated with the domain, separated by space.
wildcard

The wildcard field indicates whether the DNS record is part of a wildcard entry. To determine this:

  • We replace the last domain level with a random string, creating a new Fully Qualified Domain Name (FQDN) as a subdomain.
  • We then query the nameserver for this newly generated FQDN.
  • If the nameserver returns a DNS record for this random subdomain, the original domain is marked as a wildcard entry.

If the field is true, it means:

  • The domain has a wildcard DNS configuration (e.g., *.example.com).
  • Any subdomain of the form sub.example.com will resolve to a valid DNS record, as the wildcard (*) catches all subdomains not explicitly defined.

If the field is false, it means:

  • Only explicitly defined subdomains will have corresponding DNS records.
  • A query for a random subdomain (e.g., sub.example.com) will not resolve to a valid DNS record unless it has been specifically configured.

If the field is empty, it means that we have not yet checked the DNS record for this domain.

Possible values: true | false
active

The active field shows whether a DNS record exists for the given domain. The check works as follows:

  • The FQDN is queried multiple times against the DNS server.
  • If a valid DNS record is returned, the domain is marked as active.
  • If the DNS server returns an error or no record is found during these queries, the domain is marked as not active.

If the field is true, it means:

  • The DNS record was successfully retrieved.
  • The domain's DNS resolution was successful.

If the field is false, it means:

  • The DNS record could not be retrieved.
  • The domain's DNS resolution was unsuccessful during our attempts.

If the field is empty, it means that we have not yet checked the DNS record for this domain.

Possible values: true | false

AAAA files

  • Columns: d,du,ips,wildcard,active
  • Example: 0--f.blogspot.hr,1726563076,2607:f8b0:4006:81f::2001,,true
d
Domain or subdomain name.
du
UNIX timestamp of the last visit/update on current record. If there is more than one IP address, the timestamp corresponds to all of them.
ips
List of IPs associated with the domain, separated by space.
wildcard

The wildcard field indicates whether the DNS record is part of a wildcard entry. To determine this:

  • We replace the last domain level with a random string, creating a new Fully Qualified Domain Name (FQDN) as a subdomain.
  • We then query the nameserver for this newly generated FQDN.
  • If the nameserver returns a DNS record for this random subdomain, the original domain is marked as a wildcard entry.

If the field is true, it means:

  • The domain has a wildcard DNS configuration (e.g., *.example.com).
  • Any subdomain of the form sub.example.com will resolve to a valid DNS record, as the wildcard (*) catches all subdomains not explicitly defined.

If the field is false, it means:

  • Only explicitly defined subdomains will have corresponding DNS records.
  • A query for a random subdomain (e.g., sub.example.com) will not resolve to a valid DNS record unless it has been specifically configured.

If the field is empty, it means that we have not yet checked the DNS record for this domain.

Possible values: true | false
active

The active field shows whether a DNS record exists for the given domain. The check works as follows:

  • The FQDN is queried multiple times against the DNS server.
  • If a valid DNS record is returned, the domain is marked as active.
  • If the DNS server returns an error or no record is found during these queries, the domain is marked as not active.

If the field is true, it means:

  • The DNS record was successfully retrieved.
  • The domain's DNS resolution was successful.

If the field is false, it means:

  • The DNS record could not be retrieved.
  • The domain's DNS resolution was unsuccessful during our attempts.

If the field is empty, it means that we have not yet checked the DNS record for this domain.

Possible values: true | false

MX files

  • Columns: d,du,pr,mx,wildcard,active
  • Example: 0-0.im,1725900527,65,route1.mx.cloudflare.net,,true
  • Notice: One domain can have multiple MX records. In that case, next lines will have the same domain name and different MX records.
d
Domain or subdomain name.
du
UNIX timestamp of the last visit/update on current record.
pr
Priority identifies which mailserver should be preferred.
mx
The MX record associated with the domain.
wildcard

The wildcard field indicates whether the DNS record is part of a wildcard entry. To determine this:

  • We replace the last domain level with a random string, creating a new Fully Qualified Domain Name (FQDN) as a subdomain.
  • We then query the nameserver for this newly generated FQDN.
  • If the nameserver returns a DNS record for this random subdomain, the original domain is marked as a wildcard entry.

If the field is true, it means:

  • The domain has a wildcard DNS configuration (e.g., *.example.com).
  • Any subdomain of the form sub.example.com will resolve to a valid DNS record, as the wildcard (*) catches all subdomains not explicitly defined.

If the field is false, it means:

  • Only explicitly defined subdomains will have corresponding DNS records.
  • A query for a random subdomain (e.g., sub.example.com) will not resolve to a valid DNS record unless it has been specifically configured.

If the field is empty, it means that we have not yet checked the DNS record for this domain.

Possible values: true | false
active

The active field shows whether a DNS record exists for the given domain. The check works as follows:

  • The FQDN is queried multiple times against the DNS server.
  • If a valid DNS record is returned, the domain is marked as active.
  • If the DNS server returns an error or no record is found during these queries, the domain is marked as not active.

If the field is true, it means:

  • The DNS record was successfully retrieved.
  • The domain's DNS resolution was successful.

If the field is false, it means:

  • The DNS record could not be retrieved.
  • The domain's DNS resolution was unsuccessful during our attempts.

If the field is empty, it means that we have not yet checked the DNS record for this domain.

Possible values: true | false

NS files

  • Columns: d,du,ns,wildcard,active
  • Example: 0--1.net,1725227715,dns02.muumuu-domain.com,,true
  • Notice: One domain can have multiple NS records. In that case, next lines will have the same domain name and different NS records.
d
Domain or subdomain name.
du
UNIX timestamp of the last visit/update on current record.
ns
The NS record associated with the domain.
wildcard

The wildcard field indicates whether the DNS record is part of a wildcard entry. To determine this:

  • We replace the last domain level with a random string, creating a new Fully Qualified Domain Name (FQDN) as a subdomain.
  • We then query the nameserver for this newly generated FQDN.
  • If the nameserver returns a DNS record for this random subdomain, the original domain is marked as a wildcard entry.

If the field is true, it means:

  • The domain has a wildcard DNS configuration (e.g., *.example.com).
  • Any subdomain of the form sub.example.com will resolve to a valid DNS record, as the wildcard (*) catches all subdomains not explicitly defined.

If the field is false, it means:

  • Only explicitly defined subdomains will have corresponding DNS records.
  • A query for a random subdomain (e.g., sub.example.com) will not resolve to a valid DNS record unless it has been specifically configured.

If the field is empty, it means that we have not yet checked the DNS record for this domain.

Possible values: true | false
active

The active field shows whether a DNS record exists for the given domain. The check works as follows:

  • The FQDN is queried multiple times against the DNS server.
  • If a valid DNS record is returned, the domain is marked as active.
  • If the DNS server returns an error or no record is found during these queries, the domain is marked as not active.

If the field is true, it means:

  • The DNS record was successfully retrieved.
  • The domain's DNS resolution was successful.

If the field is false, it means:

  • The DNS record could not be retrieved.
  • The domain's DNS resolution was unsuccessful during our attempts.

If the field is empty, it means that we have not yet checked the DNS record for this domain.

Possible values: true | false

TXT files

  • Columns: d,du,txt,wildcard,active
  • Example: 0--1.net,1725227715,v=spf1 include:_spf.heteml.jp ~all,,true
  • Notice: One domain can have multiple TXT records. In that case, next lines will have the same domain name and different TXT records.
d
Domain or subdomain name.
du
UNIX timestamp of the last visit/update on current record.
txt
The TXT record associated with the domain.
wildcard

The wildcard field indicates whether the DNS record is part of a wildcard entry. To determine this:

  • We replace the last domain level with a random string, creating a new Fully Qualified Domain Name (FQDN) as a subdomain.
  • We then query the nameserver for this newly generated FQDN.
  • If the nameserver returns a DNS record for this random subdomain, the original domain is marked as a wildcard entry.

If the field is true, it means:

  • The domain has a wildcard DNS configuration (e.g., *.example.com).
  • Any subdomain of the form sub.example.com will resolve to a valid DNS record, as the wildcard (*) catches all subdomains not explicitly defined.

If the field is false, it means:

  • Only explicitly defined subdomains will have corresponding DNS records.
  • A query for a random subdomain (e.g., sub.example.com) will not resolve to a valid DNS record unless it has been specifically configured.

If the field is empty, it means that we have not yet checked the DNS record for this domain.

Possible values: true | false
active

The active field shows whether a DNS record exists for the given domain. The check works as follows:

  • The FQDN is queried multiple times against the DNS server.
  • If a valid DNS record is returned, the domain is marked as active.
  • If the DNS server returns an error or no record is found during these queries, the domain is marked as not active.

If the field is true, it means:

  • The DNS record was successfully retrieved.
  • The domain's DNS resolution was successful.

If the field is false, it means:

  • The DNS record could not be retrieved.
  • The domain's DNS resolution was unsuccessful during our attempts.

If the field is empty, it means that we have not yet checked the DNS record for this domain.

Possible values: true | false

CNAME files

  • Columns: d,du,cname,wildcard,active
  • Example: 0--6.hb.cldmail.ru,1724661484,hb.cldmail.ru,,true
  • Notice: One domain can have multiple CNAME records. In that case, next lines will have the same domain name and different CNAME records.
d
Domain or subdomain name.
du
UNIX timestamp of the last visit/update on current record.
cname
The CNAME record associated with the domain.
wildcard

The wildcard field indicates whether the DNS record is part of a wildcard entry. To determine this:

  • We replace the last domain level with a random string, creating a new Fully Qualified Domain Name (FQDN) as a subdomain.
  • We then query the nameserver for this newly generated FQDN.
  • If the nameserver returns a DNS record for this random subdomain, the original domain is marked as a wildcard entry.

If the field is true, it means:

  • The domain has a wildcard DNS configuration (e.g., *.example.com).
  • Any subdomain of the form sub.example.com will resolve to a valid DNS record, as the wildcard (*) catches all subdomains not explicitly defined.

If the field is false, it means:

  • Only explicitly defined subdomains will have corresponding DNS records.
  • A query for a random subdomain (e.g., sub.example.com) will not resolve to a valid DNS record unless it has been specifically configured.

If the field is empty, it means that we have not yet checked the DNS record for this domain.

Possible values: true | false
active

The active field shows whether a DNS record exists for the given domain. The check works as follows:

  • The FQDN is queried multiple times against the DNS server.
  • If a valid DNS record is returned, the domain is marked as active.
  • If the DNS server returns an error or no record is found during these queries, the domain is marked as not active.

If the field is true, it means:

  • The DNS record was successfully retrieved.
  • The domain's DNS resolution was successful.

If the field is false, it means:

  • The DNS record could not be retrieved.
  • The domain's DNS resolution was unsuccessful during our attempts.

If the field is empty, it means that we have not yet checked the DNS record for this domain.

Possible values: true | false

SOA files

  • Columns: d,du,soa,wildcard,active
  • Example: 0--1.net,1725227715,dns01.muumuu-domain.com. postmaster.0--1.net. 1724718394 3600 1800 604800 3600,,true
  • Notice: One domain can have multiple SOA records. In that case, next lines will have the same domain name and different SOA records.
d
Domain or subdomain name.
du
UNIX timestamp of the last visit/update on current record.
soa
The SOA record associated with the domain.
wildcard

The wildcard field indicates whether the DNS record is part of a wildcard entry. To determine this:

  • We replace the last domain level with a random string, creating a new Fully Qualified Domain Name (FQDN) as a subdomain.
  • We then query the nameserver for this newly generated FQDN.
  • If the nameserver returns a DNS record for this random subdomain, the original domain is marked as a wildcard entry.

If the field is true, it means:

  • The domain has a wildcard DNS configuration (e.g., *.example.com).
  • Any subdomain of the form sub.example.com will resolve to a valid DNS record, as the wildcard (*) catches all subdomains not explicitly defined.

If the field is false, it means:

  • Only explicitly defined subdomains will have corresponding DNS records.
  • A query for a random subdomain (e.g., sub.example.com) will not resolve to a valid DNS record unless it has been specifically configured.

If the field is empty, it means that we have not yet checked the DNS record for this domain.

Possible values: true | false
active

The active field shows whether a DNS record exists for the given domain. The check works as follows:

  • The FQDN is queried multiple times against the DNS server.
  • If a valid DNS record is returned, the domain is marked as active.
  • If the DNS server returns an error or no record is found during these queries, the domain is marked as not active.

If the field is true, it means:

  • The DNS record was successfully retrieved.
  • The domain's DNS resolution was successful.

If the field is false, it means:

  • The DNS record could not be retrieved.
  • The domain's DNS resolution was unsuccessful during our attempts.

If the field is empty, it means that we have not yet checked the DNS record for this domain.

Possible values: true | false

PTR files

  • Columns: ip,du,ptr,wildcard,active
  • Example: 1.0.100.10,1723329288,10.100.0.1.megaegg.ne.jp,,
  • Notice: One IP can have multiple PTR records. In that case, next lines will have the same IP address and different PTR records.
ip
IP address.
du
UNIX timestamp of the last visit/update on current record.
ptr
The PTR record associated with the IP.
wildcard
PTR files datafeed contains a wildcard field for parsing compatibility, it's always empty.
active

The active field shows whether a DNS record exists for the given domain. The check works as follows:

  • The FQDN is queried multiple times against the DNS server.
  • If a valid DNS record is returned, the domain is marked as active.
  • If the DNS server returns an error or no record is found during these queries, the domain is marked as not active.

If the field is true, it means:

  • The DNS record was successfully retrieved.
  • The domain's DNS resolution was successful.

If the field is false, it means:

  • The DNS record could not be retrieved.
  • The domain's DNS resolution was unsuccessful during our attempts.

If the field is empty, it means that we have not yet checked the DNS record for this domain.

Possible values: true | false