DNS and Subdomains API
Search domains, resolve DNS records, enumerate subdomains, and map nameserver relationships across the gTLD namespace. Includes the full Domain Activity feed.
What the feed contains
The DNS and Subdomains plan builds on the Domain Activity feed, adding the ability to actively query DNS infrastructure. Resolve records for any domain, enumerate observed subdomains, search across the gTLD namespace, and map nameserver relationships. Designed to support integration into threat intelligence pipelines, security tooling, and internal investigation workflows.
ccTLD domain search is available as an experimental beta feature. Coverage is non-comprehensive and results may vary by ccTLD. It is not recommended for production use cases requiring complete coverage.
API endpoint
Features
gTLD Domain Search
Search across the full gTLD namespace. Find domains by keyword, pattern, or exact match with full zone file coverage.
ccTLD Domain Search (Beta)
Experimental search across ccTLD domains. Non-comprehensive coverage. Useful for supplementary research but not suitable as a primary data source.
DNS Record Resolution
Retrieve A, CNAME, AAAA, NS, MX, and TXT records for any domain. Suitable for bulk lookups within pipelines and automated investigation workflows.
Subdomain Enumeration (Beta)
Find observed subdomains via A and CNAME records for any domain. Non-comprehensive. Results are based on observed DNS data and may not reflect all active subdomains.
Nameserver Search and Mapping
Search and list gTLD nameservers, and retrieve all domains hosted on any given nameserver. Useful for mapping hosting infrastructure and identifying shared hosting relationships.
ASN and IP Data
Retrieve the Autonomous System Number and AS Name for any IP address. Useful for mapping domain infrastructure back to hosting providers and networks.
Domain Activity Included
The full Domain Activity feed is included. Daily added and deleted gTLD domains plus keyword position monitoring, all in one subscription.
Trademark and Malware Analysis
Keyword-based monitoring for trademark terms and malware-related patterns across the daily domain activity data.
Coverage
| Feature | Coverage | Notes |
|---|---|---|
| gTLD domain search | Full | Zone file sourced, all gTLDs |
| ccTLD domain search | Beta | Non-comprehensive, experimental |
| DNS record lookups | Full | A, CNAME, AAAA, NS, MX, TXT |
| Subdomain enumeration | Beta | Based on observed A/CNAME records |
| Nameserver search | Full | gTLD nameservers only |
| ASN and IP data | Full | Any IP address |