Historical DNS Records
Look Up Which Values a Domain Has Resolved to and When.
One call to DNS History returns the historical DNS records of a domain or host: each distinct value Deepinfo’s passive DNS has observed for it, each with the times it was seen. For the history of many names at once, talk to our data team.
A records
acme.example
-
203.0.113.10stoppedAug 16 to Sep 5 2026
: seen 2026-09-05, 2026-08-27, 2026-08-16 (newest first). -
198.51.100.24startedSep 9 to Sep 18 2026
: seen 2026-09-18, 2026-09-14, 2026-09-09 (newest first).
Many names at once: ask our data team
Query One Name for Each Value It Has Had.
Pass a domain or host, and a record type if you only want one. Values that have since changed or been removed stay in the response, each with the times it was observed.
| Parameter | Type | Description | |
|---|---|---|---|
domain | string | Required | A domain or host name, for example deepinfo.com. |
type | string | Optional | A record type such as A. Leave it out for all types. |
Request
curl "https://api.deepinfo.com/v1/analyze/dns-history?domain=deepinfo.com&type=A" \
-H "apikey: YOUR_API_KEY"import requests
r = requests.get(
"https://api.deepinfo.com/v1/analyze/dns-history",
params={"domain": "deepinfo.com", "type": "A"},
headers={"apikey": "YOUR_API_KEY"},
)
for rec in r.json()["records"]:
for v in rec["values"]:
print(rec["type"], v["value"], min(v["time"]), max(v["time"]))const r = await fetch(
'https://api.deepinfo.com/v1/analyze/dns-history?domain=deepinfo.com&type=A',
{ headers: { apikey: 'YOUR_API_KEY' } }
)
const { records } = await r.json()
for (const rec of records)
for (const v of rec.values) console.log(rec.type, v.value, v.time.length)Response
{
"fqdn": "deepinfo.com",
"dn": "deepinfo.com",
"subdomain": null,
"records": [
{
"type": "a",
"values": [
{
"value": "104.26.10.21",
"time": ["2026-09-18T05:41:26Z", "2026-09-05T21:26:18Z", "…"]
},
{
"value": "172.67.70.198",
"time": ["2026-09-18T05:41:26Z", "…"]
}
]
}
]
}Questions That Need Many Names at Once.
One call per name suits an investigation. These questions cover thousands of names at once, and that is the conversation to have with our data team.
Shared infrastructure
Which Names Shared an Address
Group domains that resolved to shared IP addresses over time, including ones that have since moved elsewhere.
Which Names Shared Mail Servers
Cluster domains by the mail servers they pointed to, often a common thread between the sites of one campaign.
Timelines
What a Case Looked Like on a Date
Rebuild the DNS state of all indicators in a case for the day the incident started, in one pass.
DNS History Is One Layer of the Index.
DNS History reads stored observations from the index behind the Deepinfo Platform. The index as a whole holds:
For Bulk History, Start With the Question.
-
01
Scope
Tell us which names or zones, which record types and which period your analysis needs.
-
02
Pipeline
Tell us how your team loads data and how large a delivery it can take.
-
03
Answer
Our data team tells you what can be provided for that scope, and in what form.
See This Data at Work in the Deepinfo Platform
External Attack Surface Management runs these lookups continuously over your assets and raises what changes as issues, and Deep Search & Insights opens the whole index to your analysts.
Questions About Historical DNS Records
Is there an API endpoint for bulk DNS history?
No. The public API answers DNS history one domain or host per call, through DNS History. For many names at once, talk to our data team.
How far back does the history go?
It depends on the name. DNS History returns all values Deepinfo has observed for it with their observation times, so the earliest time in the response is the earliest observation we hold.
Can we find every name that resolved to an IP address?
Use Domain Search on ip_. It keeps each address a name has resolved to over time, so one query finds the names across the index that used the address, including ones that have moved since.
Does DNS History cover hostnames as well as domains?
Yes. Pass a host such as www.deepinfo.com; the response names its registered domain in dn and the subdomain part in subdomain.
Can we get the current records instead?
Yes. DNS Lookup resolves the record types you ask for on a name in real time, in one call.
In what order are the observation times?
Newest first, in UTC: the first entry in a value’s time list is its latest sighting, the last entry its earliest.
Bring Your DNS Question to Our Data Team.
Tell us the names, the record types and the period you need. We tell you what we can deliver and how.