# Reverse NS API URL: https://www.deepinfo.com/data-api/apis/reverse-ns/ ## List the Domains That Share One Name Server. The Reverse NS API takes a name server hostname and returns the domains in Deepinfo’s index that use it, each as a full domain record with WHOIS, DNS, certificate and web data already attached. [Talk to us about access](https://www.deepinfo.com/contact/?topic=data-api) [Reverse NS reference](https://docs.deepinfo.com/reference/discovery/reverse-ns/) ### A Name Server Hostname Returns Domain Records. Results come back in the envelope all Discovery finders share: the page, the total match count and the matching domain records. GET `https://api.deepinfo.com/v1/discovery/reverse-ns` [Reference](https://docs.deepinfo.com/reference/discovery/reverse-ns/) | Parameter | Type | | Description | | --- | --- | --- | --- | | `ns` | string | Required | The name server hostname, for example `ns1.dns-host.example`. | | `apex` | boolean | Optional | Default `false`. Set `true` to match at the apex level rather than on the exact hostname. The [reference](https://docs.deepinfo.com/reference/discovery/reverse-ns/#ref-query-parameters) has the current definition. | | `include_subdomains` | boolean | Optional | Default `false`. Set `true` to return matching subdomains as well as registered domains. | | `page` | integer | Optional | Page number, from 1. | | `page_size` | integer | Optional | Results per page. See [pagination](https://docs.deepinfo.com/getting-started/pagination/). | | `ordering` | string | Optional | Field to sort by. Prefix `-` for descending. | | `export` | boolean | Optional | Return the result set as an export instead of a page. Default `false`. | | `export_format` | string | Optional | `json` or `csv`. | | `export_scope` | string | Optional | How much of each record to include: `basic`, `default` or `extended`. | Request curl: ```bash curl "https://api.deepinfo.com/v1/discovery/reverse-ns?ns=ns1.dns-host.example&page_size=25" \ -H "apikey: YOUR_API_KEY" ``` Python: ```python import requests r = requests.get( "https://api.deepinfo.com/v1/discovery/reverse-ns", params={"ns": "ns1.dns-host.example", "page_size": 25}, headers={"apikey": "YOUR_API_KEY"}, ) data = r.json() print(data["result_count"]) for d in data["results"]: ns = (d.get("dns") or {}).get("ns") or {} print(d["punycode"], ns.get("name_servers")) ``` JavaScript: ```javascript const r = await fetch( 'https://api.deepinfo.com/v1/discovery/reverse-ns?ns=ns1.dns-host.example&page_size=25', { headers: { apikey: 'YOUR_API_KEY' } } ) const { result_count, results } = await r.json() console.log(result_count, results.map((d) => d.punycode)) ``` Response 200 OK · application/json ```json { "page": 1, "page_size": 25, "result_count": 3, "results": [ { "punycode": "acme-billing.example", "unicode": "acme-billing.example", "is_idn": false, "type": 1, "domain": { "whois": { "create_date": "2025-11-03T09:41:12Z", "registrar": "…", "name_servers": ["ns1.dns-host.example", "ns2.dns-host.example"], "…": "…" }, "…": "…" }, "dns": { "ns": { "update_date": "2026-09-10T21:31:14Z", "name_servers": ["ns1.dns-host.example", "ns2.dns-host.example"] }, "a": { "ip_addresses": ["203.0.113.24"] }, "…": "aaaa, mx, soa, txt, cname" }, "ip_history": ["203.0.113.24"], "ssl": { "…": "…" }, "webdata": { "…": "…" } }, { "punycode": "acme-status.example", "…": "domain record" }, { "punycode": "acme-careers.example", "…": "domain record" } ] } ``` `result_count` is the total number of matches across all pages. An invalid parameter, such as a non-boolean `apex`, returns a 400 that names it. Plan-dependent [rate limits](https://docs.deepinfo.com/getting-started/rate-limits/) apply, one request per second by default. ### The Count Tells You What You’ve Found. One call answers a different question depending on the name server you ask about. Few results #### A Dedicated Name Server A self-run or vanity name server usually serves one operator, so the domains on it are candidates for a common owner. Confirm with the registrant or certificate organization in each record. Many results #### A Shared DNS Provider A managed DNS provider serves many unrelated customers, so sharing its name servers says little on its own. Pair it with a second signal, such as the registrant or the registration time. In each result #### Its Full Name Server Set Each record carries the domain’s complete NS set with an update date. A less common name server in that set is often the better next query. ### Workflows This Pivot Plugs Into. #### [Threat Hunting](https://www.deepinfo.com/solutions/use-cases/threat-hunting/) Cluster adversary infrastructure by the name servers it reuses from one campaign to the next. #### [Incident Investigation](https://www.deepinfo.com/solutions/use-cases/incident-investigation-and-response/) Turn a name server from incident telemetry into the list of domains that share it, while the case is still open. #### [Brand Impersonation](https://www.deepinfo.com/solutions/use-cases/brand-impersonation-protection/) See what else sits on the name servers behind a confirmed impersonation domain. #### [Subsidiary Oversight](https://www.deepinfo.com/solutions/use-cases/subsidiary-oversight/) List the domains delegated to your corporate name servers, including ones registered by group companies. ### Other One-Call Pivots. - [Reverse MX](https://www.deepinfo.com/data-api/apis/reverse-mx/) (Discovery): Domains that route their mail through a given mail server. - [Reverse IP](https://www.deepinfo.com/data-api/apis/reverse-ip/) (Discovery): Domains on an IP address, or on its /8, /16 or /24 network. - [Reverse WHOIS Email](https://www.deepinfo.com/data-api/apis/reverse-whois-email/) (Discovery): Domains registered to an email address or email domain. ### See This Data at Work in the Deepinfo Platform External Attack Surface Management runs these lookups continuously over your assets and raises what changes as issues, and Deep Search & Insights opens the whole index to your analysts. - [External Attack Surface Management](https://www.deepinfo.com/platform/easm/) (EASM) - [Deep Search & Insights](https://www.deepinfo.com/platform/dsi/) (DSI) - [How the Platform Works](https://www.deepinfo.com/platform/how-it-works/) ### Questions About Reverse NS API **Does it read name servers from DNS or from WHOIS?** From DNS: a domain matches when its NS record names the server. The name servers listed in WHOIS are a separate field, `domain.whois.name_servers`, which [Domain Search](https://www.deepinfo.com/data-api/apis/domain-search/) can filter. **Can we combine a name server with other conditions?** Yes, in [Domain Search](https://www.deepinfo.com/data-api/apis/domain-search/). Filter `dns.ns.name_servers` together with a registrar, a registration date or an extension in one body. **How is the Reverse NS API priced?** As part of an API services plan, priced by volume and frequency, separately from the platform. See [Data & API pricing](https://www.deepinfo.com/pricing/#data-pricing). **Can analysts run this pivot without writing code?** Yes. Deep Search & Insights runs Reverse NS and the other pivots in the Deepinfo Platform. See [Domain Search](https://www.deepinfo.com/platform/dsi/domain-search/). ### Start With Name Servers You Know. Most teams start with their own name servers and one from a recent case. We set up access and answer schema questions on a short call. [Talk to us about access](https://www.deepinfo.com/contact/?topic=data-api) [All API services](https://www.deepinfo.com/data-api/apis/)