# DNS History API URL: https://www.deepinfo.com/data-api/apis/dns-history/ ## List the DNS Values a Name Has Had and When We Saw Them. The DNS History API takes a domain or hostname, and a record type if you want only one. The API returns the distinct values Deepinfo has observed for it, including values that have since changed or been removed, each with the list of times it was seen. [Talk to us about access](https://www.deepinfo.com/contact/?topic=data-api) [DNS History reference](https://docs.deepinfo.com/reference/lookup/dns-history/) ### Follow One Name’s Records Over Time. Values are grouped by record type, and each value carries its own observation times. A change shows up where one value’s sightings stop and the next value’s begin. GET `https://api.deepinfo.com/v1/analyze/dns-history` [Reference](https://docs.deepinfo.com/reference/lookup/dns-history/) | Parameter | Type | | Description | | --- | --- | --- | --- | | `domain` | string | Required | A domain or hostname, for example `deepinfo.com` or `www.deepinfo.com`. IP addresses are not accepted. | | `type` | string | Optional | One record type, such as `A`, `AAAA`, `MX`, `NS`, `SOA` or `TXT`. Leave it out to get every type. | Request curl: ```bash curl "https://api.deepinfo.com/v1/analyze/dns-history?domain=deepinfo.com&type=A" \ -H "apikey: YOUR_API_KEY" ``` Python: ```python import requests r = requests.get( "https://api.deepinfo.com/v1/analyze/dns-history", params={"domain": "deepinfo.com", "type": "A"}, headers={"apikey": "YOUR_API_KEY"}, ) for rec in r.json()["records"]: for v in rec["values"]: # times are newest first print(rec["type"], v["value"], v["time"][-1], v["time"][0]) ``` JavaScript: ```javascript const r = await fetch( 'https://api.deepinfo.com/v1/analyze/dns-history?domain=deepinfo.com&type=A', { headers: { apikey: 'YOUR_API_KEY' } } ) const { records } = await r.json() for (const rec of records) for (const v of rec.values) console.log(rec.type, v.value, v.time.at(-1), v.time[0]) ``` Response 200 OK · application/json ```json { "fqdn": "deepinfo.com", "dn": "deepinfo.com", "subdomain": null, "records": [ { "type": "a", "values": [ { "value": "104.26.10.21", "time": [ "2026-09-18T05:41:26Z", "2026-09-05T21:26:18Z", "2026-08-16T16:37:59Z" ] }, { "value": "172.67.70.198", "time": ["2026-09-18T05:41:26Z", "…"] }, "…" ] } ] } ``` ### When Today’s Answer Is Not Enough. #### [Incident Investigation](https://www.deepinfo.com/solutions/use-cases/incident-investigation-and-response/) Find what a hostname pointed at on the day of the incident, not only what it points at today. #### [Threat Hunting](https://www.deepinfo.com/solutions/use-cases/threat-hunting/) Follow suspicious infrastructure as it moves between addresses, mail servers and name servers. #### [Domain Research](https://www.deepinfo.com/solutions/use-cases/domain-intelligence-and-research/) See when a domain changed hosting, mail or DNS provider, and what it used before. ### Timestamps, Types and Your Assets. - **Record types**: `type` is lower case in the response, for example `a` or `mx`. - **Timestamps**: Each value’s `time` list is in UTC and newest first: `time[0]` is the latest sighting, the last entry the earliest. - **Your assets**: For assets you monitor in [External Attack Surface Management](https://www.deepinfo.com/platform/easm/continuous-scanning/), each DNS snapshot is also kept per asset, next to that asset’s WHOIS, SSL and port scan history. - **Rate limits**: Plan-dependent. The default is one request per second per key and endpoint. See [rate limits](https://docs.deepinfo.com/getting-started/rate-limits/). - **Errors**: `400` when `domain` is not a valid name. See [errors](https://docs.deepinfo.com/getting-started/errors/). ### Other Ways Through Time. - [WHOIS History](https://www.deepinfo.com/data-api/apis/whois-history/): Each distinct registration record of a domain, with the dates it was seen. - [DNS](https://www.deepinfo.com/data-api/apis/dns-lookup/) (Lookup): What the name resolves to right now, record type by record type. - [Reverse IP](https://www.deepinfo.com/data-api/apis/reverse-ip/) (Discovery): Domains that resolve to an address, or to its network. ### Questions About DNS History API **How far back does the history go?** It depends on the name. The response holds all values Deepinfo has observed for it, so the oldest time in the `time` lists is the earliest observation the index holds. **Can we query a hostname instead of a domain?** Yes, for example `www.deepinfo.com`. The response names its registered domain in `dn` and the subdomain part in `subdomain`, which is `null` for a domain. **Can we find every name that pointed to an IP address?** Use [Domain Search](https://www.deepinfo.com/data-api/apis/domain-search/) on `ip_history` or `domain.ip_history`. Both hold each address a name has resolved to over time, so the filter also finds names that have since moved. **Can we pull DNS history for many names at once?** Not through a public endpoint: this call answers for one name. For many names, see [Historical DNS Records](https://www.deepinfo.com/data-api/feeds/historical-dns-records/) and tell our data team what your analysis needs. **How is the DNS History API priced?** As part of an API services plan, priced by volume and frequency, separately from the platform. See [Data & API pricing](https://www.deepinfo.com/pricing/#data-pricing) or [talk to us](https://www.deepinfo.com/contact/?topic=data-api). **Can analysts read DNS history without writing code?** Yes. [Instant Lookups](https://www.deepinfo.com/platform/dsi/instant-lookups/) shows DNS History in the Deepinfo Platform, next to the live DNS lookup. ### Trace a Name You Already Know. Pull the history of one of your domains first and check it against what you remember changing. We set up access and answer schema questions on a short call. [Talk to us about access](https://www.deepinfo.com/contact/?topic=data-api) [All API services](https://www.deepinfo.com/data-api/apis/)