Request demo

DNS Lookup API

Resolve Any Hostname’s DNS Records as They Stand Now.

The DNS Lookup API takes a domain or hostname and the record types you want. It resolves them in real time and returns, for each type, the response code, the parsed values and the answer in zone-file form.

Talk to us about access DNS reference

Request

GET /lookup/dns?domain=deepinfo.com&type=A,MX

Response · 200 OK

  1. type

    AMX

    2 of 5 types in one request

  2. A

    104.26.10.21 · 104.26.11.21 · …

    conn_status success · rcode NOERROR · server 8.8.8.8

  3. MX

    1 aspmx.l.google.com · 5 alt1.aspmx.l.google.com

    conn_status success · rcode NOERROR

One unit per request, however many types it asks for1 unit

check_date 2026-09-22T12:25:59Z

Ask for Several Types and Get One Entry Each.

Each requested type comes back as its own entry, with its own response code and connection status, so a failed type does not hide the answers for the others.

GET https://api.deepinfo.com/v1/lookup/dns Reference
ParameterTypeDescription
domainstringRequiredA domain or hostname, for example deepinfo.com or www.deepinfo.com. IP addresses are not accepted.
typestringRequiredRecord types, comma-separated, up to five: A, AAAA, CNAME, MX, NS, SOA, TXT and others.

Request

curl "https://api.deepinfo.com/v1/lookup/dns?domain=deepinfo.com&type=A,MX" \
  -H "apikey: YOUR_API_KEY"

Response

200 OK · application/json 
{
  "fqdn": "deepinfo.com",
  "requested_types": ["A", "MX"],
  "responses": [
    {
      "type": "A",
      "conn_status": "success",
      "rcode": "NOERROR",
      "values": ["104.26.10.21", "104.26.11.21", "…"],
      "raw": "deepinfo.com. 300 IN A 104.26.11.21\n…",
      "server": "8.8.8.8"
    },
    {
      "type": "MX",
      "conn_status": "success",
      "rcode": "NOERROR",
      "values": ["1 aspmx.l.google.com", "5 alt1.aspmx.l.google.com", "…"],
      "…": "…"
    }
  ],
  "servers": ["8.8.8.8"],
  "check_date": "2026-09-22T12:25:59Z"
}

What Each Field Tells You.

The parsed values are there for your code. The raw answer is there for the cases where you need what the resolver said, TTL included.

FieldMeaning
requested_typesThe record types you asked for.
responses[].conn_statussuccess, or timeout when no answer came back for that type.
responses[].rcodeThe DNS response code, such as NOERROR or NXDOMAIN.
responses[].valuesParsed record values. MX values keep their preference number.
responses[].rawThe answer in zone-file form, with the TTL of each record.
responses[].server, serversThe resolver that answered each type, and every resolver used.
check_dateWhen the lookup ran, in UTC.

Raw raw · the answer in zone-file form

  1. deepinfo.com. name fqdn
  2. 300 TTL raw only
  3. IN class raw only
  4. A type type
  5. 104.26.11.21 value values

Parsed · for your code

type A conn_status success rcode NOERROR values 104.26.10.21, 104.26.11.21, … server 8.8.8.8

When the Current Answer Is the Question.

Incident Investigation

Resolve the hostnames in an alert to their current addresses and mail servers without running a resolver fleet.

Use case

Phishing Triage

Check whether a newly seen lookalike already has MX records, which means it is set up to receive mail.

Use case

Attack Surface Checks

Confirm that a record you changed, or one a scan flagged, now resolves the way it should.

Use case

Quota, Limits and What It Won’t Take.

Live vs historyThis call resolves the name now. The values a name has had, with the times Deepinfo observed them, come from the DNS History API.
QuotaOne unit per request, however many types it asks for.
AddressesThe call takes names, not IPs. For the domains that point at an IP, use Reverse IP.
Rate limitsPlan-dependent. The default is one request per second per key and endpoint. See rate limits.
Errors400 when domain is not a valid name or type is missing. See errors.

Other Ways Into One Name.

History DNS History The values Deepinfo has observed for a name, with each time it was seen. Read Lookup Domain WHOIS Registrar, dates and name servers for a domain, raw and parsed. Read Lookup SSL The certificate a host serves right now, with a verdict on its chain. Read

See This Data at Work in the Deepinfo Platform

External Attack Surface Management runs these lookups continuously over your assets and raises what changes as issues, and Deep Search & Insights opens the whole index to your analysts.

Questions About DNS Lookup API

Does a name that does not exist return an error?

No. You get an entry for each requested type, and its rcode holds the DNS response code, such as NXDOMAIN for a name that does not exist.

Can we resolve many names at once?

Each call takes one name, so a list means one call per name within your rate limit. For names already in the index, Domain Search returns the DNS records Deepinfo last observed for many names in one query: filter fqdn with in.

Can we go the other way, from a mail or name server to its domains?

Yes, with the reverse lookups. Reverse MX lists the domains that use a mail server and Reverse NS the ones that use a name server, each as a full domain record.

How is the DNS Lookup API priced?

As part of an API services plan, priced by volume and frequency, separately from the platform. See Data & API pricing or talk to us about the volume you expect.

Can analysts run DNS lookups without writing code?

Yes. Instant Lookups in Deep Search & Insights resolves names in the Deepinfo Platform, next to WHOIS, SSL and the other live lookups.

Resolve Your Domains First.

Most teams test the API against their own domains before they wire it into a pipeline. We set up access and answer schema questions on a short call.

Talk to us about access All API services