Reverse NS API
List the Domains That Share One Name Server.
The Reverse NS API takes a name server hostname and returns the domains in Deepinfo’s index that use it, each as a full domain record with WHOIS, DNS, certificate and web data already attached.
name server ns1.dns-host.example
- Reverse NS GET /discovery/reverse-ns
- acme-billing.example (the next pivot starts here)created 2025-11-03 · NS ns1, ns2.dns-host.example (updated 2026-09-10) · A 203.0.113.24
- acme-status.example
- acme-careers.example
Each record carries its complete NS set with an update date.
A Name Server Hostname Returns Domain Records.
Results come back in the envelope all Discovery finders share: the page, the total match count and the matching domain records.
| Parameter | Type | Description | |
|---|---|---|---|
ns | string | Required | The name server hostname, for example ns1.dns-host.example. |
apex | boolean | Optional | Default false. Set true to match at the apex level rather than on the exact hostname. The reference has the current definition. |
include_ | boolean | Optional | Default false. Set true to return matching subdomains as well as registered domains. |
page | integer | Optional | Page number, from 1. |
page_ | integer | Optional | Results per page. See pagination. |
ordering | string | Optional | Field to sort by. Prefix - for descending. |
export | boolean | Optional | Return the result set as an export instead of a page. Default false. |
export_ | string | Optional | json or csv. |
export_ | string | Optional | How much of each record to include: basic, default or extended. |
Request
curl "https://api.deepinfo.com/v1/discovery/reverse-ns?ns=ns1.dns-host.example&page_size=25" \
-H "apikey: YOUR_API_KEY"import requests
r = requests.get(
"https://api.deepinfo.com/v1/discovery/reverse-ns",
params={"ns": "ns1.dns-host.example", "page_size": 25},
headers={"apikey": "YOUR_API_KEY"},
)
data = r.json()
print(data["result_count"])
for d in data["results"]:
ns = (d.get("dns") or {}).get("ns") or {}
print(d["punycode"], ns.get("name_servers"))const r = await fetch(
'https://api.deepinfo.com/v1/discovery/reverse-ns?ns=ns1.dns-host.example&page_size=25',
{ headers: { apikey: 'YOUR_API_KEY' } }
)
const { result_count, results } = await r.json()
console.log(result_count, results.map((d) => d.punycode))Response
{
"page": 1,
"page_size": 25,
"result_count": 3,
"results": [
{
"punycode": "acme-billing.example",
"unicode": "acme-billing.example",
"is_idn": false,
"type": 1,
"domain": {
"whois": {
"create_date": "2025-11-03T09:41:12Z",
"registrar": "…",
"name_servers": ["ns1.dns-host.example", "ns2.dns-host.example"],
"…": "…"
},
"…": "…"
},
"dns": {
"ns": {
"update_date": "2026-09-10T21:31:14Z",
"name_servers": ["ns1.dns-host.example", "ns2.dns-host.example"]
},
"a": { "ip_addresses": ["203.0.113.24"] },
"…": "aaaa, mx, soa, txt, cname"
},
"ip_history": ["203.0.113.24"],
"ssl": { "…": "…" },
"webdata": { "…": "…" }
},
{ "punycode": "acme-status.example", "…": "domain record" },
{ "punycode": "acme-careers.example", "…": "domain record" }
]
}result_ is the total number of matches across all pages. An invalid parameter, such as a non-boolean apex, returns a 400 that names it. Plan-dependent rate limits apply, one request per second by default.
The Count Tells You What You’ve Found.
One call answers a different question depending on the name server you ask about.
Few results
A Dedicated Name Server
A self-run or vanity name server usually serves one operator, so the domains on it are candidates for a common owner. Confirm with the registrant or certificate organization in each record.
Many results
A Shared DNS Provider
A managed DNS provider serves many unrelated customers, so sharing its name servers says little on its own. Pair it with a second signal, such as the registrant or the registration time.
In each result
Its Full Name Server Set
Each record carries the domain’s complete NS set with an update date. A less common name server in that set is often the better next query.
Workflows This Pivot Plugs Into.
Threat Hunting
Cluster adversary infrastructure by the name servers it reuses from one campaign to the next.
Incident Investigation
Turn a name server from incident telemetry into the list of domains that share it, while the case is still open.
Brand Impersonation
See what else sits on the name servers behind a confirmed impersonation domain.
Subsidiary Oversight
List the domains delegated to your corporate name servers, including ones registered by group companies.
See This Data at Work in the Deepinfo Platform
External Attack Surface Management runs these lookups continuously over your assets and raises what changes as issues, and Deep Search & Insights opens the whole index to your analysts.
Questions About Reverse NS API
Does it read name servers from DNS or from WHOIS?
From DNS: a domain matches when its NS record names the server. The name servers listed in WHOIS are a separate field, domain.whois.name_, which Domain Search can filter.
Can we combine a name server with other conditions?
Yes, in Domain Search. Filter dns.ns.name_ together with a registrar, a registration date or an extension in one body.
How is the Reverse NS API priced?
As part of an API services plan, priced by volume and frequency, separately from the platform. See Data & API pricing.
Can analysts run this pivot without writing code?
Yes. Deep Search & Insights runs Reverse NS and the other pivots in the Deepinfo Platform. See Domain Search.
Start With Name Servers You Know.
Most teams start with their own name servers and one from a recent case. We set up access and answer schema questions on a short call.