▸ DNS lookup and record history
Look up the A, AAAA, NS, MX and TXT records we resolved for any domain, and see every change since we started recording. Not a live query: this is what the record set actually was, month by month.
Enter a domain to see its records and how they have changed.
DNSniffer resolves every domain it knows about once a month and keeps the answer. This page is the front door to that archive: type a domain and you get its current record set plus every interval we have recorded, across roughly 492,927,803 domains and 3,208,031,821 stored record intervals.
The difference from any other DNS lookup tool is the second half. A live dig tells you what a domain resolves to right now. This tells you what it resolved to last March, when the mail host changed, and whether the nameservers you are looking at have been there for years or arrived last month.
▸ How the archive is built
- ▸ One pass a month
- Every domain in the corpus is resolved on a monthly cycle. The pass runs continuously at a low rate rather than in a burst, so no authoritative operator sees a spike from us.
- ▸ Five record types
- We query A, AAAA, MX and TXT. NS comes from the zone file where one exists and is queried otherwise. SOA is not collected: it is almost never what anyone is looking for.
- ▸ Intervals, not snapshots
- Each value is stored once with a first-seen and a last-seen date, not once per month. A record that never changes is one row, which is what makes years of history affordable.
- ▸ Gaps are preserved
- A value that disappears for a month and comes back opens a second interval rather than extending the first. The outage stays visible instead of being smoothed away by the storage layer.
- ▸ Absence is recorded too
- Roughly a quarter of registered domains resolve to nothing. We store that as
nxdomainornodata, so "no records" and "never checked" are different answers. - ▸ Queried from our own resolver
- Lookups go through a recursive resolver we run, spread across a large address range and identified by reverse DNS pointing at our crawler page. No third-party resolver sits in the middle.
▸ Try a lookup
| Domain | What it shows |
|---|---|
| example.com | The reserved documentation domain. Small, stable record set. |
| github.com | A large site with several A records and a long TXT block. |
| wikipedia.org | Anycast addresses and mail records across a big infrastructure. |
| cloudflare.com | The nameserver operator behind roughly a fifth of all NS records. |
Each example is a live lookup against the archive, not a canned result.
▸ What people use it for
Infrastructure archaeology
Work out when a domain moved host, changed mail provider or switched registrar, without having had a monitor running at the time.
Threat investigation
Pivot from an IP to every domain that pointed at it, or check whether a domain used in an incident was parked before it went live.
Attack surface review
Find the forgotten subdomain still pointing at a decommissioned host, and see how long it has been that way.
Migration verification
Confirm a DNS cutover actually propagated to the authoritative servers, and that the old records really stopped being served.
▸ What is in the archive
The corpus is every domain DNSniffer tracks, which comes from two places: the gTLD zone files we are licensed to download, and every hostname observed in Certificate Transparency. That second source is what puts ccTLD domains in here at all, since there is no zone file for them.
Because the archive is built from our own queries rather than from a third-party feed, the results are ours to publish. NS records taken from zone files are treated differently and are not part of the bulk downloads.
- ▸ Around 492,927,803 domains resolved, most recent completed pass 2026-10-12.
- ▸ A, AAAA, MX and TXT queried directly; NS taken from the zone file where one exists.
- ▸ Every value carries the date it was first seen and the date it was last confirmed.
▸ What this is not
- It is not a live query. The most recent answer here is from the last completed pass, which can be up to a month old. If you need what a domain resolves to this second, run dig.
- A change between two passes is invisible. A record that appeared and disappeared inside one month never existed as far as this archive is concerned.
- History starts when we started. There is no backfill and no way to recover what a domain resolved to before the first pass. The archive only gets more useful with time.
▸ Questions
? How many domains are covered?
Around 492,927,803. Every domain in a gTLD zone file we can download, plus every domain seen in Certificate Transparency, which is how ccTLD domains get in.
? How often is a domain re-resolved?
Once a month. A full pass takes several days and runs continuously at a low rate rather than all at once, so a given domain is re-checked roughly every 30 days.
? Why is SOA missing?
It was dropped on purpose. SOA is present for about three quarters of live domains and is almost never the thing anyone is looking up, so querying it would be a third of the traffic for very little value.
? What does "does not exist" mean here?
That the authoritative nameserver answered NXDOMAIN: the name is not registered, or it is registered but has no delegation. It is stored as a fact in its own right, which is why it is distinguishable from a domain we have simply never checked.
? Can I get this in bulk?
Yes. Monthly per-TLD exports are produced from the same archive and are available as downloads. Records we queried ourselves are included; NS records taken from zone files are not.
? Is there an API?
Yes, at /api/v1/dns/492,927,803. It returns the current set, the set as of a past date, or every recorded interval, and it is reachable over MCP as well.