# Historical DNS Records URL: https://www.deepinfo.com/data-api/feeds/historical-dns-records/ ## Look Up Which Values a Domain Has Resolved to and When. One call to DNS History returns the historical DNS records of a domain or host: each distinct value Deepinfo’s passive DNS has observed for it, each with the times it was seen. For the history of many names at once, talk to our data team. [DNS History API](https://www.deepinfo.com/data-api/apis/dns-history/) · [Talk to our data team](https://www.deepinfo.com/contact/?topic=data-api) ### Query One Name for Each Value It Has Had. Pass a domain or host, and a record type if you only want one. Values that have since changed or been removed stay in the response, each with the times it was observed. GET `https://api.deepinfo.com/v1/analyze/dns-history` [Reference](https://docs.deepinfo.com/reference/lookup/dns-history/) | Parameter | Type | | Description | | --- | --- | --- | --- | | `domain` | string | Required | A domain or host name, for example `deepinfo.com`. | | `type` | string | Optional | A record type such as `A`. Leave it out for all types. | Request curl: ```bash curl "https://api.deepinfo.com/v1/analyze/dns-history?domain=deepinfo.com&type=A" \ -H "apikey: YOUR_API_KEY" ``` Python: ```python import requests r = requests.get( "https://api.deepinfo.com/v1/analyze/dns-history", params={"domain": "deepinfo.com", "type": "A"}, headers={"apikey": "YOUR_API_KEY"}, ) for rec in r.json()["records"]: for v in rec["values"]: print(rec["type"], v["value"], min(v["time"]), max(v["time"])) ``` JavaScript: ```javascript const r = await fetch( 'https://api.deepinfo.com/v1/analyze/dns-history?domain=deepinfo.com&type=A', { headers: { apikey: 'YOUR_API_KEY' } } ) const { records } = await r.json() for (const rec of records) for (const v of rec.values) console.log(rec.type, v.value, v.time.length) ``` Response 200 OK · application/json ```json { "fqdn": "deepinfo.com", "dn": "deepinfo.com", "subdomain": null, "records": [ { "type": "a", "values": [ { "value": "104.26.10.21", "time": ["2026-09-18T05:41:26Z", "2026-09-05T21:26:18Z", "…"] }, { "value": "172.67.70.198", "time": ["2026-09-18T05:41:26Z", "…"] } ] } ] } ``` ### Questions That Need Many Names at Once. One call per name suits an investigation. These questions cover thousands of names at once, and that is the conversation to have with our data team. Shared infrastructure #### Which Names Shared an Address Group domains that resolved to shared IP addresses over time, including ones that have since moved elsewhere. Mail #### Which Names Shared Mail Servers Cluster domains by the mail servers they pointed to, often a common thread between the sites of one campaign. Timelines #### What a Case Looked Like on a Date Rebuild the DNS state of all indicators in a case for the day the incident started, in one pass. ### DNS History Is One Layer of the Index. DNS History reads stored observations from the index behind the Deepinfo Platform. The index as a whole holds: - 400M+ domains: across every TLD - 2B+ subdomains: discovered and resolved - 200B+ DNS records: cumulative, with history - 30B+ SSL certificates: indexed ### For Bulk History, Start With the Question. 1. **Scope** Tell us which names or zones, which record types and which period your analysis needs. 2. **Pipeline** Tell us how your team loads data and how large a delivery it can take. 3. **Answer** Our data team tells you what can be provided for that scope, and in what form. ### Other History You Can Call Today. - [DNS History](https://www.deepinfo.com/data-api/apis/dns-history/) (API): The values a domain or host has resolved to. - [Reverse IP](https://www.deepinfo.com/data-api/apis/reverse-ip/) (API): The domains that resolve to an address or its network today. - [Historical WHOIS Records](https://www.deepinfo.com/data-api/feeds/historical-whois-records/) (History): Each distinct registration record of a domain, with dates. ### See This Data at Work in the Deepinfo Platform External Attack Surface Management runs these lookups continuously over your assets and raises what changes as issues, and Deep Search & Insights opens the whole index to your analysts. - [External Attack Surface Management](https://www.deepinfo.com/platform/easm/) (EASM) - [Deep Search & Insights](https://www.deepinfo.com/platform/dsi/) (DSI) - [How the Platform Works](https://www.deepinfo.com/platform/how-it-works/) ### Questions About Historical DNS Records **Is there an API endpoint for bulk DNS history?** No. The public API answers DNS history one domain or host per call, through [DNS History](https://www.deepinfo.com/data-api/apis/dns-history/). For many names at once, [talk to our data team](https://www.deepinfo.com/contact/). **How far back does the history go?** It depends on the name. DNS History returns all values Deepinfo has observed for it with their observation times, so the earliest time in the response is the earliest observation we hold. **Can we find every name that resolved to an IP address?** Use [Domain Search](https://www.deepinfo.com/data-api/apis/domain-search/) on `ip_history`. It keeps each address a name has resolved to over time, so one query finds the names across the index that used the address, including ones that have moved since. **Does DNS History cover hostnames as well as domains?** Yes. Pass a host such as `www.deepinfo.com`; the response names its registered domain in `dn` and the subdomain part in `subdomain`. **Can we get the current records instead?** Yes. [DNS Lookup](https://www.deepinfo.com/data-api/apis/dns-lookup/) resolves the record types you ask for on a name in real time, in one call. **In what order are the observation times?** Newest first, in UTC: the first entry in a value’s `time` list is its latest sighting, the last entry its earliest. ### Bring Your DNS Question to Our Data Team. Tell us the names, the record types and the period you need. We tell you what we can deliver and how. [Talk to our data team](https://www.deepinfo.com/contact/?topic=data-api) [DNS History API](https://www.deepinfo.com/data-api/apis/dns-history/)