Premium database

Samples

The premium database comes in five forms, which include A, AAAA, MX, NS, TXT, CNAME, SOA, and PTR records and can be downloaded in CSV. The Premium DNS Database offers all current and historical DNS records.

Subscription type	Description
Daily updates	Include DNS records (A, AAAA, MX, NS, TXT, CNAME, SOA, PTR) that have been added during a previous day in the weekly full database for a given date in unified and consistent CSV format. These files are located in the daily_datafeed subdirectory and are named in format: - "daily_datafeed/premium_dns_database.%DATE%.daily.csv.gz" - "daily_datafeed/premium_dns_aaaa_database.%DATE%.daily.csv.gz" - "daily_datafeed/premium_dns_mx_database.%DATE%.daily.csv.gz" - "daily_datafeed/premium_dns_ns_database.%DATE%.daily.csv.gz", - "daily_datafeed/premium_dns_txt_database.%DATE%.daily.csv.gz", - "daily_datafeed/premium_dns_cname_database.%DATE%.daily.csv.gz", - "daily_datafeed/premium_dns_soa_database.%DATE%.daily.csv.gz", - "daily_datafeed/premium_dns_ptr_database.%DATE%.daily.csv.gz", e.g. "daily_datafeed/premium_dns_database.2021-12-01.daily.csv.gz".
Weekly updates	Include changes in the weekly full database of DNS records compared to the previous period. Includes added, dropped, and modified records since the previous week. These files are named in format: - "premium_dns_database.%DATE%.weekly.diff.csv.gz" - "premium_dns_aaaa_database.%DATE%.weekly.diff.csv.gz" - "premium_dns_mx_database.%DATE%.weekly.diff.csv.gz", - "premium_dns_ns_database.%DATE%.weekly.diff.csv.gz", - "premium_dns_txt_database.%DATE%.weekly.diff.csv.gz", - "premium_dns_cname_database.%DATE%.weekly.diff.csv.gz", - "premium_dns_soa_database.%DATE%.weekly.diff.csv.gz", - "premium_dns_ptr_database.%DATE%.weekly.diff.csv.gz", e.g. "premium_dns_database.2021-12-01.weekly.diff.csv.gz".
Monthly updates	Include changes in the monthly full database of DNS records compared to the previous period. Includes added, dropped, and modified records since the previous month. These files are named in format: - "premium_dns_database.%DATE%.monthly.diff.csv.gz" - "premium_dns_aaaa_database.%DATE%.monthly.diff.csv.gz" - "premium_dns_mx_database.%DATE%.monthly.diff.csv.gz", - "premium_dns_ns_database.%DATE%.monthly.diff.csv.gz", - "premium_dns_txt_database.%DATE%.monthly.diff.csv.gz", - "premium_dns_cname_database.%DATE%.monthly.diff.csv.gz", - "premium_dns_soa_database.%DATE%.monthly.diff.csv.gz", - "premium_dns_ptr_database.%DATE%.monthly.diff.csv.gz", e.g. "premium_dns_database.2021-12-01.monthly.diff.csv.gz".
Weekly Full database	A weekly full database of DNS records (A, AAAA, MX, NS, TXT, CNAME, SOA, PTR) collected for the previous 90 days before a given date in a unified and consistent CSV format. These files are named in format: - "premium_dns_database.%DATE%.full.csv.gz" - "premium_dns_aaaa_database.%DATE%.full.csv.gz" - "premium_dns_mx_database.%DATE%.full.csv.gz" - "premium_dns_ns_database.%DATE%.full.csv.gz", - "premium_dns_txt_database.%DATE%.full.csv.gz", - "premium_dns_cname_database.%DATE%.full.csv.gz", - "premium_dns_soa_database.%DATE%.full.csv.gz", - "premium_dns_ptr_database.%DATE%.full.csv.gz", e.g. "premium_dns_database.2021-12-01.full.csv.gz".
Monthly Full database	A monthly full database of DNS records (A, AAAA, MX, NS, TXT, CNAME, SOA, PTR) collected for the previous 365 days before a given date in a unified and consistent CSV format. These files are named in format: - "premium_dns_database.%DATE%.full.%PART%.csv.gz" - "premium_dns_aaaa_database.%DATE%.full.%PART%.csv.gz" - "premium_dns_mx_database.%DATE%.full.%PART%.csv.gz" - "premium_dns_ns_database.%DATE%.full.%PART%.csv.gz", - "premium_dns_txt_database.%DATE%.full.%PART%.csv.gz", - "premium_dns_cname_database.%DATE%.full.%PART%.csv.gz", - "premium_dns_soa_database.%DATE%.full.%PART%.csv.gz", - "premium_dns_ptr_database.%DATE%.full.%PART%.csv.gz", e.g. "premium_dns_database.2021-12-01.full.1.csv.gz". The %PART% in the filename indicates the part number of the monthly full database. The monthly full database is divided into multiple parts due to its size. Each part file can be unarchived separately and contains a portion of the database. The number of parts depends on the size of the database for a given month.

Note that the weekly and monthly data are derived from the concatenation of the respective daily data and the addition of the first field, the date.

Downloading via FTP

Host: datafeeds.whoisxmlapi.com
Port: 21210
Username: 'user'
Password: equal to your personal API Key which you can obtain from the My Products page.
Base path: ftp://datafeeds.whoisxmlapi.com:21210
Folder: DNS_Database_Download

When dealing with extensive data sets, factors such as download speed, round-trip times, network stability, and disk I/O can influence the successful completion of your download over the HTTP protocol. Additionally, external elements like antivirus software may introduce complexities that hinder the seamless transfer of your data. To ensure a smoother and more reliable download experience, we highly recommend utilizing the FTP (File Transfer Protocol) option whenever possible. FTP provides a robust solution that minimizes the impact of potential challenges associated with HTTP downloads. If you encounter download errors or face any difficulties, we encourage you to reach out to our dedicated support department. They will be more than happy to assist you in enabling FTP access, thereby optimizing your data transfer process.

Downloading via HTTPS

Base path: https://download.whoisxmlapi.com/datafeeds/
Username and password: equal to your personal API Key which you can obtain from the My Products page.
Folder: DNS_Database_Download_Premium

Downloading via FTPS

Read more about the FTPS connection: https://en.wikipedia.org/wiki/FTPS.

Our FTP server supports explicit FTP over TLS encryption. You may configure your FTP client to use explicit FTP over TLS encryption for secure communications.

Our FTPS server is accessed using the same paths and API keys as a regular FTP server, the instructions for which are described above. To connect via FTPS, select the "Require explicit FTP over TLS" encryption option in your FTP client, if it supports it. FileZilla configuration example:

Average file sizes

Measured as of 18 October 2024.

A files

File content	Filename suffix	Avg. gzipped file size	Avg. unpacked file size	Avg. number of records
Weekly full database export	.full	292.3GB	1.3TB	27.1B
Weekly changes in the full database	.weekly.diff	25.5GB	114.9GB	2.4B
Monthly changes in the full database	.monthly.diff	107.8GB	479.8GB	10.1B
Records added during the previous day	.daily	3.4GB	16.2GB	345.2M

MX files

File content	Filename suffix	Avg. gzipped file size	Avg. unpacked file size	Avg. number of records
Weekly full database export	.full	5.0GB	31.9GB	457.1M
Weekly changes in the full database	.weekly.diff	158MB	1.5GB	10.4M
Monthly changes in the full database	.monthly.diff	837.8MB	7.5GB	59.6M
Records added during the previous day	.daily	76.5MB	543.5MB	7.2M

NS files

File content	Filename suffix	Avg. gzipped file size	Avg. unpacked file size	Avg. number of records
Weekly full database export	.full	8.8GB	56.2GB	1.0B
Weekly changes in the full database	.weekly.diff	268.9MB	1.7GB	26.6M
Monthly changes in the full database	.monthly.diff	1.6GB	10.6GB	163.6M
Records added during the previous day	.daily	142.7MB	902.2MB	16.5M

TXT files

File content	Filename suffix	Avg. gzipped file size	Avg. unpacked file size	Avg. number of records
Weekly full database export	.full	8.2GB	42.6GB	461.5M
Weekly changes in the full database	.weekly.diff	619.2MB	6.2GB	52.9M
Monthly changes in the full database	.monthly.diff	3.3GB	30.4GB	265.5M
Records added during the previous day	.daily	168.2MB	1.1GB	10.8M

CNAME files

File content	Filename suffix	Avg. gzipped file size	Avg. unpacked file size	Avg. number of records
Weekly full database export	.full	1.9GB	9.9GB	110.4M
Weekly changes in the full database	.weekly.diff	245.4MB	1.5GB	14.1M
Monthly changes in the full database	.monthly.diff	1.3GB	7.8GB	72.8M
Records added during the previous day	.daily	44.8MB	260.6MB	2.7M

SOA files

File content	Filename suffix	Avg. gzipped file size	Avg. unpacked file size	Avg. number of records
Weekly full database export	.full	9.1GB	47.1GB	424.2M
Weekly changes in the full database	.weekly.diff	417.7MB	2.2GB	19.3M
Monthly changes in the full database	.monthly.diff	2.3GB	12.2GB	104.4M
Records added during the previous day	.daily	144.0MB	743.2MB	6.7M

AAAA files

File content	Filename suffix	Avg. gzipped file size	Avg. unpacked file size	Avg. number of records
Weekly full database export	.full	15.8GB	86.5GB	1.7B
Weekly changes in the full database	.weekly.diff	1.4GB	8.0GB	147.7M
Monthly changes in the full database	.monthly.diff	6.8GB	38.8GB	746.8M
Records added during the previous day	.daily	220MB	1.2GB	22.3M

PTR files

File content	Filename suffix	Avg. gzipped file size	Avg. unpacked file size	Avg. number of records
Weekly full database export	.full	4.7GB	30.5GB	491.4M
Weekly changes in the full database	.weekly.diff	80.0MB	391.5MB	5.4M
Monthly changes in the full database	.monthly.diff	386.3MB	2.0GB	27.3M
Records added during the previous day	.daily	27.8MB	131.4MB	2M

CSV output structure and fields' descriptions

The database files are comma-separated value-files without text delimiters. The files use DOS/Windows - style line terminators (CR+LF). The first line is a header line with the field names. Each line has four or five fields depending on the subscription type:

A files

Columns: d,du,ips,wildcard,active
Example: 0--1.net,1725227709,157.7.189.251,,true

d	Domain or subdomain name.
du	UNIX timestamp of the last visit/update on current record. If there is more than one IP address, the timestamp corresponds to all of them.
ips	List of IPs associated with the domain, separated by space.
wildcard	The wildcard field indicates whether the DNS record is part of a wildcard entry. To determine this: We replace the last domain level with a random string, creating a new Fully Qualified Domain Name (FQDN) as a subdomain. We then query the nameserver for this newly generated FQDN. If the nameserver returns a DNS record for this random subdomain, the original domain is marked as a wildcard entry. If the field is true, it means: The domain has a wildcard DNS configuration (e.g., .example.com). Any subdomain of the form sub.example.com will resolve to a valid DNS record, as the wildcard () catches all subdomains not explicitly defined. If the field is false, it means: Only explicitly defined subdomains will have corresponding DNS records. A query for a random subdomain (e.g., sub.example.com) will not resolve to a valid DNS record unless it has been specifically configured. If the field is empty, it means that we have not yet checked the DNS record for this domain. Possible values: true \| false
active	The active field shows whether a DNS record exists for the given domain. The check works as follows: The FQDN is queried multiple times against the DNS server. If a valid DNS record is returned, the domain is marked as active. If the DNS server returns an error or no record is found during these queries, the domain is marked as not active. If the field is true, it means: The DNS record was successfully retrieved. The domain's DNS resolution was successful. If the field is false, it means: The DNS record could not be retrieved. The domain's DNS resolution was unsuccessful during our attempts. If the field is empty, it means that we have not yet checked the DNS record for this domain. Possible values: true \| false

AAAA files

Columns: d,du,ips,wildcard,active
Example: 0--f.blogspot.hr,1726563076,2607:f8b0:4006:81f::2001,,true

d	Domain or subdomain name.
du	UNIX timestamp of the last visit/update on current record. If there is more than one IP address, the timestamp corresponds to all of them.
ips	List of IPs associated with the domain, separated by space.
wildcard	The wildcard field indicates whether the DNS record is part of a wildcard entry. To determine this: We replace the last domain level with a random string, creating a new Fully Qualified Domain Name (FQDN) as a subdomain. We then query the nameserver for this newly generated FQDN. If the nameserver returns a DNS record for this random subdomain, the original domain is marked as a wildcard entry. If the field is true, it means: The domain has a wildcard DNS configuration (e.g., .example.com). Any subdomain of the form sub.example.com will resolve to a valid DNS record, as the wildcard () catches all subdomains not explicitly defined. If the field is false, it means: Only explicitly defined subdomains will have corresponding DNS records. A query for a random subdomain (e.g., sub.example.com) will not resolve to a valid DNS record unless it has been specifically configured. If the field is empty, it means that we have not yet checked the DNS record for this domain. Possible values: true \| false
active	The active field shows whether a DNS record exists for the given domain. The check works as follows: The FQDN is queried multiple times against the DNS server. If a valid DNS record is returned, the domain is marked as active. If the DNS server returns an error or no record is found during these queries, the domain is marked as not active. If the field is true, it means: The DNS record was successfully retrieved. The domain's DNS resolution was successful. If the field is false, it means: The DNS record could not be retrieved. The domain's DNS resolution was unsuccessful during our attempts. If the field is empty, it means that we have not yet checked the DNS record for this domain. Possible values: true \| false

MX files

Columns: d,du,pr,mx,wildcard,active
Example: 0--midwesttvwww0.cp.attdealer.biz,1721198887,5,mail.h-email.net,,
Notice: One domain can have multiple MX records. In that case, next lines will have the same domain name and different MX records.

d	Domain or subdomain name.
du	UNIX timestamp of the last visit/update on current record.
pr	Priority identifies which mailserver should be preferred.
mx	The MX record associated with the domain.
wildcard	The wildcard field indicates whether the DNS record is part of a wildcard entry. To determine this: We replace the last domain level with a random string, creating a new Fully Qualified Domain Name (FQDN) as a subdomain. We then query the nameserver for this newly generated FQDN. If the nameserver returns a DNS record for this random subdomain, the original domain is marked as a wildcard entry. If the field is true, it means: The domain has a wildcard DNS configuration (e.g., .example.com). Any subdomain of the form sub.example.com will resolve to a valid DNS record, as the wildcard () catches all subdomains not explicitly defined. If the field is false, it means: Only explicitly defined subdomains will have corresponding DNS records. A query for a random subdomain (e.g., sub.example.com) will not resolve to a valid DNS record unless it has been specifically configured. If the field is empty, it means that we have not yet checked the DNS record for this domain. Possible values: true \| false
active	The active field shows whether a DNS record exists for the given domain. The check works as follows: The FQDN is queried multiple times against the DNS server. If a valid DNS record is returned, the domain is marked as active. If the DNS server returns an error or no record is found during these queries, the domain is marked as not active. If the field is true, it means: The DNS record was successfully retrieved. The domain's DNS resolution was successful. If the field is false, it means: The DNS record could not be retrieved. The domain's DNS resolution was unsuccessful during our attempts. If the field is empty, it means that we have not yet checked the DNS record for this domain. Possible values: true \| false

NS files

Columns: d,du,ns,wildcard,active
Example: 0--0--------dra-dot-ru-premium-domains-and-services-----------0.ru,1725059015,dns2.dra.ru,,true
Notice: One domain can have multiple NS records. In that case, next lines will have the same domain name and different NS records.

d	Domain or subdomain name.
du	UNIX timestamp of the last visit/update on current record.
ns	The NS record associated with the domain.
wildcard	The wildcard field indicates whether the DNS record is part of a wildcard entry. To determine this: We replace the last domain level with a random string, creating a new Fully Qualified Domain Name (FQDN) as a subdomain. We then query the nameserver for this newly generated FQDN. If the nameserver returns a DNS record for this random subdomain, the original domain is marked as a wildcard entry. If the field is true, it means: The domain has a wildcard DNS configuration (e.g., .example.com). Any subdomain of the form sub.example.com will resolve to a valid DNS record, as the wildcard () catches all subdomains not explicitly defined. If the field is false, it means: Only explicitly defined subdomains will have corresponding DNS records. A query for a random subdomain (e.g., sub.example.com) will not resolve to a valid DNS record unless it has been specifically configured. If the field is empty, it means that we have not yet checked the DNS record for this domain. Possible values: true \| false
active	The active field shows whether a DNS record exists for the given domain. The check works as follows: The FQDN is queried multiple times against the DNS server. If a valid DNS record is returned, the domain is marked as active. If the DNS server returns an error or no record is found during these queries, the domain is marked as not active. If the field is true, it means: The DNS record was successfully retrieved. The domain's DNS resolution was successful. If the field is false, it means: The DNS record could not be retrieved. The domain's DNS resolution was unsuccessful during our attempts. If the field is empty, it means that we have not yet checked the DNS record for this domain. Possible values: true \| false

TXT files

Columns: d,du,txt,wildcard,active
Example: 0--1.net,1725227715,kktXekKsyn2pYYDIjdoTe2AuSYy8MO79iSdGSmUVExY=,,true
Notice: One domain can have multiple TXT records. In that case, next lines will have the same domain name and different TXT records.

d	Domain or subdomain name.
du	UNIX timestamp of the last visit/update on current record.
txt	The TXT record associated with the domain.
wildcard	The wildcard field indicates whether the DNS record is part of a wildcard entry. To determine this: We replace the last domain level with a random string, creating a new Fully Qualified Domain Name (FQDN) as a subdomain. We then query the nameserver for this newly generated FQDN. If the nameserver returns a DNS record for this random subdomain, the original domain is marked as a wildcard entry. If the field is true, it means: The domain has a wildcard DNS configuration (e.g., .example.com). Any subdomain of the form sub.example.com will resolve to a valid DNS record, as the wildcard () catches all subdomains not explicitly defined. If the field is false, it means: Only explicitly defined subdomains will have corresponding DNS records. A query for a random subdomain (e.g., sub.example.com) will not resolve to a valid DNS record unless it has been specifically configured. If the field is empty, it means that we have not yet checked the DNS record for this domain. Possible values: true \| false
active	The active field shows whether a DNS record exists for the given domain. The check works as follows: The FQDN is queried multiple times against the DNS server. If a valid DNS record is returned, the domain is marked as active. If the DNS server returns an error or no record is found during these queries, the domain is marked as not active. If the field is true, it means: The DNS record was successfully retrieved. The domain's DNS resolution was successful. If the field is false, it means: The DNS record could not be retrieved. The domain's DNS resolution was unsuccessful during our attempts. If the field is empty, it means that we have not yet checked the DNS record for this domain. Possible values: true \| false

CNAME files

Columns: d,du,cname,wildcard,active
Example: 0--4.huobichain.com,1725585331,www.huobichain.com.cdn.cloudflare.net,,
Notice: One domain can have multiple CNAME records. In that case, next lines will have the same domain name and different CNAME records.

d	Domain or subdomain name.
du	UNIX timestamp of the last visit/update on current record.
cname	The CNAME record associated with the domain.
wildcard	The wildcard field indicates whether the DNS record is part of a wildcard entry. To determine this: We replace the last domain level with a random string, creating a new Fully Qualified Domain Name (FQDN) as a subdomain. We then query the nameserver for this newly generated FQDN. If the nameserver returns a DNS record for this random subdomain, the original domain is marked as a wildcard entry. If the field is true, it means: The domain has a wildcard DNS configuration (e.g., .example.com). Any subdomain of the form sub.example.com will resolve to a valid DNS record, as the wildcard () catches all subdomains not explicitly defined. If the field is false, it means: Only explicitly defined subdomains will have corresponding DNS records. A query for a random subdomain (e.g., sub.example.com) will not resolve to a valid DNS record unless it has been specifically configured. If the field is empty, it means that we have not yet checked the DNS record for this domain. Possible values: true \| false
active	The active field shows whether a DNS record exists for the given domain. The check works as follows: The FQDN is queried multiple times against the DNS server. If a valid DNS record is returned, the domain is marked as active. If the DNS server returns an error or no record is found during these queries, the domain is marked as not active. If the field is true, it means: The DNS record was successfully retrieved. The domain's DNS resolution was successful. If the field is false, it means: The DNS record could not be retrieved. The domain's DNS resolution was unsuccessful during our attempts. If the field is empty, it means that we have not yet checked the DNS record for this domain. Possible values: true \| false

SOA files

Columns: d,du,soa,wildcard,active
Example: 0--1.net,1725227715,dns01.muumuu-domain.com. postmaster.0--1.net. 1724718394 3600 1800 604800 3600,,true
Notice: One domain can have multiple SOA records. In that case, next lines will have the same domain name and different SOA records.

d	Domain or subdomain name.
du	UNIX timestamp of the last visit/update on current record.
soa	The SOA record associated with the domain.
wildcard	The wildcard field indicates whether the DNS record is part of a wildcard entry. To determine this: We replace the last domain level with a random string, creating a new Fully Qualified Domain Name (FQDN) as a subdomain. We then query the nameserver for this newly generated FQDN. If the nameserver returns a DNS record for this random subdomain, the original domain is marked as a wildcard entry. If the field is true, it means: The domain has a wildcard DNS configuration (e.g., .example.com). Any subdomain of the form sub.example.com will resolve to a valid DNS record, as the wildcard () catches all subdomains not explicitly defined. If the field is false, it means: Only explicitly defined subdomains will have corresponding DNS records. A query for a random subdomain (e.g., sub.example.com) will not resolve to a valid DNS record unless it has been specifically configured. If the field is empty, it means that we have not yet checked the DNS record for this domain. Possible values: true \| false
active	The active field shows whether a DNS record exists for the given domain. The check works as follows: The FQDN is queried multiple times against the DNS server. If a valid DNS record is returned, the domain is marked as active. If the DNS server returns an error or no record is found during these queries, the domain is marked as not active. If the field is true, it means: The DNS record was successfully retrieved. The domain's DNS resolution was successful. If the field is false, it means: The DNS record could not be retrieved. The domain's DNS resolution was unsuccessful during our attempts. If the field is empty, it means that we have not yet checked the DNS record for this domain. Possible values: true \| false

PTR files

Columns: ip,du,ptr,wildcard,active
Example: 1.0.101.210,1722809170,210.101.0.1.megaegg.ne.jp,,
Notice: One IP can have multiple PTR records. In that case, next lines will have the same IP address and different PTR records.

ip	IP address.
du	UNIX timestamp of the last visit/update on current record.
ptr	The PTR record associated with the IP.
wildcard	PTR files datafeed contains a wildcard field for parsing compatibility, it's always empty.
active	The active field shows whether a DNS record exists for the given domain. The check works as follows: The FQDN is queried multiple times against the DNS server. If a valid DNS record is returned, the domain is marked as active. If the DNS server returns an error or no record is found during these queries, the domain is marked as not active. If the field is true, it means: The DNS record was successfully retrieved. The domain's DNS resolution was successful. If the field is false, it means: The DNS record could not be retrieved. The domain's DNS resolution was unsuccessful during our attempts. If the field is empty, it means that we have not yet checked the DNS record for this domain. Possible values: true \| false

WHOIS / WHOIS History

DNS / DNS History

IP Geolocation / IP Netblocks

Domain Research Suite (DRS)

Domain/WHOIS

DNS/IP

Intelligence

Other

Domain/WHOIS

DNS/IP

Intelligence

Other

Domain/WHOIS

DNS/IP

Intelligence

Other

Domain Research Suite (DRS)

Research

Monitoring

White-Label

Predictive Threat Intelligence Feeds

Internet Infrastructure

Enterprise API Packages

Security Intelligence (SI) Suite

Premium database

Samples

The premium database comes in five forms, which include A, AAAA, MX, NS, TXT, CNAME, SOA, and PTR records and can be downloaded in CSV. The Premium DNS Database offers all current and historical DNS records.

Downloading via FTP

Downloading via HTTPS

Downloading via FTPS

Average file sizes

A files

MX files

NS files

TXT files

CNAME files

SOA files

AAAA files

PTR files

CSV output structure and fields' descriptions

A files

AAAA files

MX files

NS files

TXT files

CNAME files

SOA files

PTR files

Have questions?