Output format | Documentation | Reverse DNS API | WhoisXML API
Products APIs Data Feeds Web Tools Domain Research & Monitoring Enterprise Packages
WHOIS / WHOIS History
WHOIS / WHOIS History

Provide current and historical ownership information on domains / IPs. Identify all connections between domains, registrants, registrars, and DNS servers.

DNS / DNS History
DNS / DNS History

Look into all current and historical DNS / IP connections between domains and A, MX, NS, and other records. Monitor suspicious changes to DNS records.

IP Geolocation / IP Netblocks
IP Geolocation / IP Netblocks

Get detailed context on an IP address, including its user’s geolocation, time zone, connected domains, connection type, IP range, ASN, and other network ownership details.

Domain Research Suite (DRS)
Domain Research Suite (DRS)

Access our web-based solution to dig into and monitor all domain events of interest.

Domain Research Suite (DRS)
Domain Research Suite (DRS)

Get access to a web-based enterprise-grade solution to search and monitor domain registrations and ownership details for branded terms, fuzzy matches, registrants of interest, and more.

Research
Monitoring
White-Label
Predictive Threat Intelligence Feeds
Predictive Threat Intelligence Feeds

Predictive threat intelligence is your best first line of defense. Subscribe to the feeds to strengthen your cybersecurity posture. Contact us today for more information.

WhoisXML API Internet Infrastructure
Internet Infrastructure

Unlock integrated intelligence on Internet properties and their ownership, infrastructure, and other attributes.

Enterprise API Packages
Enterprise API Packages

Our complete set of domain, IP, and DNS intelligence available via API calls as an annual subscription with predictable pricing.

Security Intelligence (SI) Suite
Security Intelligence (SI) Suite

Offers complete access to WHOIS, IP, DNS, and subdomain data for product enrichment, threat hunting and more.

Multi-Level API User Administration Now Available - Manage individual API keys for team members in your organization.

Learn More
×
Contact Us
API docs Integrations Pricing
Making requests Output format Error codes Server-to-Server OAuth
Balance information Generate new API key

Output format

{
    "result": [
        {
            "value": "ns1.google.com. dns-admin.google.com. 658337085 900 900 1800 60",
            "wildcard": null,
            "active": true,
            "name": "1bgo9ev2in.com",
            "first_seen": 1697553732,
            "last_visit": 1728317192
        },
        {
            "value": "ns1.google.com. dns-admin.google.com. 664077773 900 900 1800 60",
            "wildcard": null,
            "active": true,
            "name": "1bgo9ev2in.com",
            "first_seen": 1697553732,
            "last_visit": 1728317192
        },
        {
            "value": "ns1.google.com. dns-admin.google.com. 668858537 900 900 1800 60",
            "wildcard": null,
            "active": true,
            "name": "1bgo9ev2in.com",
            "first_seen": 1697553732,
            "last_visit": 1728317192
        },
        {
            "value": "ns1.google.com. dns-admin.google.com. 682618118 900 900 1800 60",
            "wildcard": null,
            "active": true,
            "name": "1bgo9ev2in.com",
            "first_seen": 1697553732,
            "last_visit": 1728317192
        },
        {
            "value": "ns1.google.com. dns-admin.google.com. 682852035 900 900 1800 60",
            "wildcard": null,
            "active": true,
            "name": "1bgo9ev2in.com",
            "first_seen": 1697553732,
            "last_visit": 1728317192
        }
    ],
    "size": 5
}

Output parameters

result
Segment contains info about the resulting DNS record data.
result[0].name
Domain name
result[0].value
DNS record value
result[0].wildcard

If the includeAdditionalChecks=1 flag wasn't passed in the query, this field will be absent in the response.

The wildcard field indicates whether the DNS record is part of a wildcard entry. To determine this:

  • We replace the last domain level with a random string, creating a new Fully Qualified Domain Name (FQDN) as a subdomain.
  • We then query the nameserver for this newly generated FQDN.
  • If the nameserver returns a DNS record for this random subdomain, the original domain is marked as a wildcard entry.

If the field is true, it means:

  • The domain has a wildcard DNS configuration (e.g., *.example.com).
  • Any subdomain of the form sub.example.com will resolve to a valid DNS record, as the wildcard (*) catches all subdomains not explicitly defined.

If the field is false, it means:

  • Only explicitly defined subdomains will have corresponding DNS records.
  • A query for a random subdomain (e.g., sub.example.com) will not resolve to a valid DNS record unless it has been specifically configured.

If the field is empty (null), it means that we have not yet checked the DNS record for this domain.

Possible values: true | false | null
result[0].active

If the includeAdditionalChecks=1 flag wasn't passed in the query, this field will be absent in the response.

The active field shows whether a DNS record exists for the given domain. The check works as follows:

  • The FQDN is queried multiple times against the DNS server.
  • If a valid DNS record is returned, the domain is marked as active.
  • If the DNS server returns an error or no record is found during these queries, the domain is marked as not active.

If the field is true, it means:

  • The DNS record was successfully retrieved.
  • The domain's DNS resolution was successful.

If the field is false, it means:

  • The DNS record could not be retrieved.
  • The domain's DNS resolution was unsuccessful during our attempts.

If the field is empty (null), it means that we have not yet checked the DNS record for this domain.

Possible values: true | false | null
result[0].first_seen
Timestamp of the first time that the record was seen.
result[0].last_visit
Timestamp of the last update for this record.
size
Number of records in result segment.