Premium database

Samples

The premium database comes in five forms, which include A, AAAA, MX, NS, TXT, CNAME, SOA, and PTR records and can be downloaded in CSV. The Premium DNS Database offers all current and historical DNS records.

Subscription type	Description
Daily updates	Include DNS records (A, AAAA, MX, NS, TXT, CNAME, SOA, PTR) that have been added during a previous day in the weekly full database for a given date in unified and consistent CSV format. These files are located in the daily_datafeed subdirectory and are named in format: - "daily_datafeed/premium_dns_database.%DATE%.daily.csv.gz" - "daily_datafeed/premium_dns_aaaa_database.%DATE%.daily.csv.gz" - "daily_datafeed/premium_dns_mx_database.%DATE%.daily.csv.gz" - "daily_datafeed/premium_dns_ns_database.%DATE%.daily.csv.gz", - "daily_datafeed/premium_dns_txt_database.%DATE%.daily.csv.gz", - "daily_datafeed/premium_dns_cname_database.%DATE%.daily.csv.gz", - "daily_datafeed/premium_dns_soa_database.%DATE%.daily.csv.gz", - "daily_datafeed/premium_dns_ptr_database.%DATE%.daily.csv.gz", e.g. "daily_datafeed/premium_dns_database.2021-12-01.daily.csv.gz".
Weekly updates	Include changes in the weekly full database of DNS records compared to the previous period. Includes added, dropped, and modified records since the previous week. These files are named in format: - "premium_dns_database.%DATE%.weekly.diff.csv.gz" - "premium_dns_aaaa_database.%DATE%.weekly.diff.csv.gz" - "premium_dns_mx_database.%DATE%.weekly.diff.csv.gz", - "premium_dns_ns_database.%DATE%.weekly.diff.csv.gz", - "premium_dns_txt_database.%DATE%.weekly.diff.csv.gz", - "premium_dns_cname_database.%DATE%.weekly.diff.csv.gz", - "premium_dns_soa_database.%DATE%.weekly.diff.csv.gz", - "premium_dns_ptr_database.%DATE%.weekly.diff.csv.gz", e.g. "premium_dns_database.2021-12-01.weekly.diff.csv.gz".
Monthly updates	Include changes in the weekly full database of DNS records compared to the previous period. Includes added, dropped, and modified records since the previous month. These files are named in format: - "premium_dns_database.%DATE%.monthly.diff.csv.gz" - "premium_dns_aaaa_database.%DATE%.monthly.diff.csv.gz" - "premium_dns_mx_database.%DATE%.monthly.diff.csv.gz", - "premium_dns_ns_database.%DATE%.monthly.diff.csv.gz", - "premium_dns_txt_database.%DATE%.monthly.diff.csv.gz", - "premium_dns_cname_database.%DATE%.monthly.diff.csv.gz", - "premium_dns_soa_database.%DATE%.monthly.diff.csv.gz", - "premium_dns_ptr_database.%DATE%.monthly.diff.csv.gz", e.g. "premium_dns_database.2021-12-01.monthly.diff.csv.gz".
Weekly Full database	A weekly full database of DNS records (A, AAAA, MX, NS, TXT, CNAME, SOA, PTR) collected for the previous 90 days before a given date in a unified and consistent CSV format. These files are named in format: - "premium_dns_database.%DATE%.full.csv.gz" - "premium_dns_aaaa_database.%DATE%.full.csv.gz" - "premium_dns_mx_database.%DATE%.full.csv.gz" - "premium_dns_ns_database.%DATE%.full.csv.gz", - "premium_dns_txt_database.%DATE%.full.csv.gz", - "premium_dns_cname_database.%DATE%.full.csv.gz", - "premium_dns_soa_database.%DATE%.full.csv.gz", - "premium_dns_ptr_database.%DATE%.full.csv.gz", e.g. "premium_dns_database.2021-12-01.full.csv.gz".
Monthly Full database	A monthly full database of DNS records (A, AAAA, MX, NS, TXT, CNAME, SOA, PTR) collected for the previous 365 days before a given date in a unified and consistent CSV format. These files are named in format: - "premium_dns_database.%DATE%.full.%PART%.csv.gz" - "premium_dns_aaaa_database.%DATE%.full.%PART%.csv.gz" - "premium_dns_mx_database.%DATE%.full.%PART%.csv.gz" - "premium_dns_ns_database.%DATE%.full.%PART%.csv.gz", - "premium_dns_txt_database.%DATE%.full.%PART%.csv.gz", - "premium_dns_cname_database.%DATE%.full.%PART%.csv.gz", - "premium_dns_soa_database.%DATE%.full.%PART%.csv.gz", - "premium_dns_ptr_database.%DATE%.full.%PART%.csv.gz", e.g. "premium_dns_database.2021-12-01.full.1.csv.gz". The %PART% in the filename indicates the part number of the monthly full database. The monthly full database is divided into multiple parts due to its size. Each part file can be unarchived separately and contains a portion of the database. The number of parts depends on the size of the database for a given month.

Note that the weekly and monthly data are derived from the concatenation of the respective daily data and the addition of the first field, the date.

Downloading via FTP

Host: datafeeds.whoisxmlapi.com
Port: 21210
Username: 'user'
Password: equal to your personal API Key which you can obtain from the My Products page.
Base path: ftp://datafeeds.whoisxmlapi.com:21210
Folder: DNS_Database_Download

When dealing with extensive data sets, factors such as download speed, round-trip times, network stability, and disk I/O can influence the successful completion of your download over the HTTP protocol. Additionally, external elements like antivirus software may introduce complexities that hinder the seamless transfer of your data. To ensure a smoother and more reliable download experience, we highly recommend utilizing the FTP (File Transfer Protocol) option whenever possible. FTP provides a robust solution that minimizes the impact of potential challenges associated with HTTP downloads. If you encounter download errors or face any difficulties, we encourage you to reach out to our dedicated support department. They will be more than happy to assist you in enabling FTP access, thereby optimizing your data transfer process.

Downloading via HTTPS

Base path: https://download.whoisxmlapi.com/datafeeds/
Username and password: equal to your personal API Key which you can obtain from the My Products page.
Folder: DNS_Database_Download_Premium

Downloading via FTPS

Read more about the FTPS connection: https://en.wikipedia.org/wiki/FTPS.

Our FTP server supports explicit FTP over TLS encryption. You may configure your FTP client to use explicit FTP over TLS encryption for secure communications.

Our FTPS server is accessed using the same paths and API keys as a regular FTP server, the instructions for which are described above. To connect via FTPS, select the "Require explicit FTP over TLS" encryption option in your FTP client, if it supports it. FileZilla configuration example:

Average file sizes

Measured as of 18 October 2024.

A files

File content	Filename suffix	Avg. gzipped file size	Avg. unpacked file size	Avg. number of records
Weekly full database export	.full	292.3GB	1.3TB	27.1B
Weekly changes in the full database	.weekly.diff	25.5GB	114.9GB	2.4B
Monthly changes in the full database	.monthly.diff	107.8GB	479.8GB	10.1B
Records added during the previous day	.daily	3.4GB	16.2GB	345.2M

MX files

File content	Filename suffix	Avg. gzipped file size	Avg. unpacked file size	Avg. number of records
Weekly full database export	.full	5.0GB	31.9GB	457.1M
Weekly changes in the full database	.weekly.diff	158MB	1.5GB	10.4M
Monthly changes in the full database	.monthly.diff	837.8MB	7.5GB	59.6M
Records added during the previous day	.daily	76.5MB	543.5MB	7.2M

NS files

File content	Filename suffix	Avg. gzipped file size	Avg. unpacked file size	Avg. number of records
Weekly full database export	.full	8.8GB	56.2GB	1.0B
Weekly changes in the full database	.weekly.diff	268.9MB	1.7GB	26.6M
Monthly changes in the full database	.monthly.diff	1.6GB	10.6GB	163.6M
Records added during the previous day	.daily	142.7MB	902.2MB	16.5M

TXT files

File content	Filename suffix	Avg. gzipped file size	Avg. unpacked file size	Avg. number of records
Weekly full database export	.full	8.2GB	42.6GB	461.5M
Weekly changes in the full database	.weekly.diff	619.2MB	6.2GB	52.9M
Monthly changes in the full database	.monthly.diff	3.3GB	30.4GB	265.5M
Records added during the previous day	.daily	168.2MB	1.1GB	10.8M

CNAME files

File content	Filename suffix	Avg. gzipped file size	Avg. unpacked file size	Avg. number of records
Weekly full database export	.full	1.9GB	9.9GB	110.4M
Weekly changes in the full database	.weekly.diff	245.4MB	1.5GB	14.1M
Monthly changes in the full database	.monthly.diff	1.3GB	7.8GB	72.8M
Records added during the previous day	.daily	44.8MB	260.6MB	2.7M

SOA files

File content	Filename suffix	Avg. gzipped file size	Avg. unpacked file size	Avg. number of records
Weekly full database export	.full	9.1GB	47.1GB	424.2M
Weekly changes in the full database	.weekly.diff	417.7MB	2.2GB	19.3M
Monthly changes in the full database	.monthly.diff	2.3GB	12.2GB	104.4M
Records added during the previous day	.daily	144.0MB	743.2MB	6.7M

AAAA files

File content	Filename suffix	Avg. gzipped file size	Avg. unpacked file size	Avg. number of records
Weekly full database export	.full	15.8GB	86.5GB	1.7B
Weekly changes in the full database	.weekly.diff	1.4GB	8.0GB	147.7M
Monthly changes in the full database	.monthly.diff	6.8GB	38.8GB	746.8M
Records added during the previous day	.daily	220MB	1.2GB	22.3M

PTR files

File content	Filename suffix	Avg. gzipped file size	Avg. unpacked file size	Avg. number of records
Weekly full database export	.full	4.7GB	30.5GB	491.4M
Weekly changes in the full database	.weekly.diff	80.0MB	391.5MB	5.4M
Monthly changes in the full database	.monthly.diff	386.3MB	2.0GB	27.3M
Records added during the previous day	.daily	27.8MB	131.4MB	2M

CSV output structure and fields' descriptions

The database files are comma-separated value-files without text delimiters. The files use DOS/Windows - style line terminators (CR+LF). The first line is a header line with the field names. Each line has four or five fields depending on the subscription type:

A files

Structure: <DOMAIN>,<LAST_UPDATE_TIMESTAMP>,<IP1> <IP2> ... <IPn>,<WILDCARD>,<ACTIVE>
Example: 0--1.net,1725227709,157.7.189.251,,true

DOMAIN	Domain or subdomain name.
LAST_UPDATE	UNIX timestamp of the last visit/update on current record. If there is more than one IP address, the timestamp corresponds to all of them.
IP1, IP2, IPn	List of IPs associated with the domain, separated by space.
WILDCARD	Shows if DNS record is part of a wildcard entry (true: under wildcard, false: not under wildcard, empty: not yet checked).
ACTIVE	Indicates domain last resolution status (true: successful, false: failed, empty: third-party record not yet resolved).

AAAA files

Structure: <DOMAIN>,<LAST_UPDATE_TIMESTAMP>,<IP1> <IP2> ... <IPn>,<WILDCARD>,<ACTIVE>
Example: 0--f.blogspot.hr,1726563076,2607:f8b0:4006:81f::2001,,true

DOMAIN	Domain or subdomain name.
LAST_UPDATE	UNIX timestamp of the last visit/update on current record. If there is more than one IP address, the timestamp corresponds to all of them.
IP1, IP2, IPn	List of IPs associated with the domain, separated by space.
WILDCARD	Shows if DNS record is part of a wildcard entry (true: under wildcard, false: not under wildcard, empty: not yet checked).
ACTIVE	Indicates domain last resolution status (true: successful, false: failed, empty: third-party record not yet resolved).

MX files

Structure:
- <DOMAIN-A>,<LAST_UPDATE_TIMESTAMP>,<PRIORITY>,<MX1>,<WILDCARD>,<ACTIVE>
- <DOMAIN-A>,<LAST_UPDATE_TIMESTAMP>,<PRIORITY>,<MX2>,<WILDCARD>,<ACTIVE>
- <DOMAIN-B>,<LAST_UPDATE_TIMESTAMP>,<PRIORITY>,<MX1>,<WILDCARD>,<ACTIVE>
- ...
Example:
- 0--midwesttvwww0.cp.attdealer.biz,1721198887,5,mail.h-email.net,,
- 0--n.com,1727465160,0,0--n.com,,true

DOMAIN	Domain or subdomain name.
LAST_UPDATE	UNIX timestamp of the last visit/update on current record.
PRIORITY	Priority identifies which mailserver should be preferred.
MX	The MX record associated with the domain.
WILDCARD	Shows if DNS record is part of a wildcard entry (true: under wildcard, false: not under wildcard, empty: not yet checked).
ACTIVE	Indicates domain last resolution status (true: successful, false: failed, empty: third-party record not yet resolved).

NS files

Structure:
- <DOMAIN-A>,<LAST_UPDATE_TIMESTAMP>,<NS1>,<WILDCARD>,<ACTIVE>
- <DOMAIN-A>,<LAST_UPDATE_TIMESTAMP>,<NS2>,<WILDCARD>,<ACTIVE>
- <DOMAIN-B>,<LAST_UPDATE_TIMESTAMP>,<NS1>,<WILDCARD>,<ACTIVE>
- ...
Example:
- 0--0--------dra-dot-ru-premium-domains-and-services-----------0.ru,1725059015,dns2.dra.ru,,true
- 0--0---api-new.localclubs.ch,1725308103,ns-1398.awsdns-46.org,,

DOMAIN	Domain or subdomain name.
LAST_UPDATE	UNIX timestamp of the last visit/update on current record.
NS	The NS record associated with the domain.
WILDCARD	Shows if DNS record is part of a wildcard entry (true: under wildcard, false: not under wildcard, empty: not yet checked).
ACTIVE	Indicates domain last resolution status (true: successful, false: failed, empty: third-party record not yet resolved).

TXT files

Structure:
- <DOMAIN-A>,<LAST_UPDATE_TIMESTAMP>,<TXT1>,<WILDCARD>,<ACTIVE>
- <DOMAIN-A>,<LAST_UPDATE_TIMESTAMP>,<TXT2>,<WILDCARD>,<ACTIVE>
- <DOMAIN-B>,<LAST_UPDATE_TIMESTAMP>,<TXT1>,<WILDCARD>,<ACTIVE>
- ...
Example:
- 0--1.net,1725227715,kktXekKsyn2pYYDIjdoTe2AuSYy8MO79iSdGSmUVExY=,,true
- 0--1.net,1725227715,v=spf1 include:_spf.heteml.jp ~all,,true

DOMAIN	Domain or subdomain name.
LAST_UPDATE	UNIX timestamp of the last visit/update on current record.
TXT	The TXT record associated with the domain.
WILDCARD	Shows if DNS record is part of a wildcard entry (true: under wildcard, false: not under wildcard, empty: not yet checked).
ACTIVE	Indicates domain last resolution status (true: successful, false: failed, empty: third-party record not yet resolved).

CNAME files

Structure:
- <DOMAIN-A>,<LAST_UPDATE_TIMESTAMP>,<CNAME1>,<WILDCARD>,<ACTIVE>
- <DOMAIN-A>,<LAST_UPDATE_TIMESTAMP>,<CNAME2>,<WILDCARD>,<ACTIVE>
- <DOMAIN-B>,<LAST_UPDATE_TIMESTAMP>,<CNAME1>,<WILDCARD>,<ACTIVE>
- ...
Example:
- 0--4.huobichain.com,1725585331,www.huobichain.com.cdn.cloudflare.net,,
- 0--6.hb.cldmail.ru,1724661484,hb.cldmail.ru,,true

DOMAIN	Domain or subdomain name.
LAST_UPDATE	UNIX timestamp of the last visit/update on current record.
CNAME	The CNAME record associated with the domain.
WILDCARD	Shows if DNS record is part of a wildcard entry (true: under wildcard, false: not under wildcard, empty: not yet checked).
ACTIVE	Indicates domain last resolution status (true: successful, false: failed, empty: third-party record not yet resolved).

SOA files

Structure:
- <DOMAIN-A>,<LAST_UPDATE_TIMESTAMP>,<SOA1>,<WILDCARD>,<ACTIVE>
- <DOMAIN-A>,<LAST_UPDATE_TIMESTAMP>,<SOA2>,<WILDCARD>,<ACTIVE>
- <DOMAIN-B>,<LAST_UPDATE_TIMESTAMP>,<SOA1>,<WILDCARD>,<ACTIVE>
- ...
Example:
- 0--1.net,1725227715,dns01.muumuu-domain.com. postmaster.0--1.net. 1724718394 3600 1800 604800 3600,,true
- 0--18support.localclubs.ch,1725348124,ns-360.awsdns-45.com. awsdns-hostmaster.amazon.com. 1 7200 900 1209600 86400,,

DOMAIN	Domain or subdomain name.
LAST_UPDATE	UNIX timestamp of the last visit/update on current record.
SOA	The SOA record associated with the domain.
WILDCARD	Shows if DNS record is part of a wildcard entry (true: under wildcard, false: not under wildcard, empty: not yet checked).
ACTIVE	Indicates domain last resolution status (true: successful, false: failed, empty: third-party record not yet resolved).

PTR files

Structure:
- <IP-A>,<LAST_UPDATE_TIMESTAMP>,<PTR1>,<WILDCARD>,<ACTIVE>
- <IP-A>,<LAST_UPDATE_TIMESTAMP>,<PTR2>,<WILDCARD>,<ACTIVE>
- <IP-B>,<LAST_UPDATE_TIMESTAMP>,<PTR1>,<WILDCARD>,<ACTIVE>
- ...
Example:
- 1.0.101.210,1722809170,210.101.0.1.megaegg.ne.jp,,
- 1.0.101.222,1723180517,222.101.0.1.megaegg.ne.jp,,

IP	IP address.
LAST_UPDATE	UNIX timestamp of the last visit/update on current record.
PTR	The PTR record associated with the IP.
WILDCARD	PTR files datafeed contains a wildcard field for parsing compatibility, it's always empty.
ACTIVE	Indicates domain last resolution status (true: successful, false: failed, empty: third-party record not yet resolved).

WHOIS / WHOIS History

DNS / DNS History

IP Geolocation / IP Netblocks

Domain Research Suite (DRS)

Domain/WHOIS

DNS/IP

Intelligence

Other

Domain/WHOIS

DNS/IP

Intelligence

Other

Domain/WHOIS

DNS/IP

Intelligence

Other

Domain Research Suite (DRS)

Research

Monitoring

White-Label

Predictive Threat Intelligence

Internet Infrastructure

Enterprise API Packages

Security Intelligence (SI) Suite

Premium database

Samples

The premium database comes in five forms, which include A, AAAA, MX, NS, TXT, CNAME, SOA, and PTR records and can be downloaded in CSV. The Premium DNS Database offers all current and historical DNS records.

Downloading via FTP

Downloading via HTTPS

Downloading via FTPS

Average file sizes

A files

MX files

NS files

TXT files

CNAME files

SOA files

AAAA files

PTR files

CSV output structure and fields' descriptions

A files

AAAA files

MX files

NS files

TXT files

CNAME files

SOA files

PTR files

Have questions?