This endpoint is extremely effective in investigating malicious infrastructure and unmasking hidden relationships between domains.

​
Examples

https://api.dns0.eu/rrsets?name=.dsp2-secure.fr
;; Fri, Jun 2, 2023 1:00 PM (UTC)
dsp2-secure.fr.	A	159.100.30.41

;; Fri, Jun 2, 2023 1:00 PM (UTC)
dsp2-secure.fr.	NS	ns-cloud-a3.googledomains.com.
dsp2-secure.fr.	NS	ns-cloud-a2.googledomains.com.
dsp2-secure.fr.	NS	ns-cloud-a1.googledomains.com.
dsp2-secure.fr.	NS	ns-cloud-a4.googledomains.com.

...
https://api.dns0.eu/rrsets?data=159.100.30.41
;; Wed, Jun 7, 2023 3:46 PM (UTC)
securisation-dsp2.fr.	A	159.100.30.41

;; Fri, Jun 2, 2023 1:00 PM (UTC)
dsp2-secure.fr.	A	159.100.30.41

;; Fri, Jun 2, 2023 11:49 AM (UTC)
securisation-axa.fr.	A	159.100.30.41

;; Tue, May 30, 2023 5:15 AM ... Sat, May 27, 2023 5:31 AM (UTC) (3 days)
secure-axa.fr.	A	159.100.30.41

;; Thu, May 25, 2023 4:47 PM (UTC)
secure-fortuneo.fr.	A	159.100.30.41

...

​
Base URL

https://api.dns0.eu/rrsets

​
Parameters

name
string

Find records by matching the name component (left-hand side).

Accepted values:

  • domain.com returns records for domain.com
  • .domain.com returns records for domain.com and all its subdomains
data
string

Find records by matching the data component (right-hand side).

Accepted values:

  • 159.100.30.41 returns records that point to this IP address
  • 159.100.30.0/24 returns records that point to any IP addresses from this CIDR
  • domain.com returns records that point to domain.com
  • .domain.com returns records that point to domain.com or any of its subdomains
  • ~spf= returns TXT records that contains spf=
  • hostmaster@example.comreturns SOA records with this email address for RNAME
  • *@example.comreturns SOA records with any email address on the example.com domain for RNAME
type
[]string | []number

Limit results to certain record types (e.g. type=NS,A,AAAA). Accepts a comma-separated list of DNS record types, either in textual or numeric form.

from
datetime

Limit results to records seen after this date (e.g. from=2022-01-01). Also accepts UNIX timestamp and relative times (e.g. from=-1M for a month ago).

to
datetime

Limit results to records seen before this date (e.g. to=2023-03-13). Also accepts UNIX timestamp and relative times (e.g. to=-1M for a month ago).

not_before
datetime

Limit results to records not seen before this date (e.g. not_before=2023-07-01). Also accepts UNIX timestamp and relative times (e.g. not_before=-1M for a month ago).

sort
string

Available sorts are first_seen (the default) or last_seen. Both are descending sorts (most recent first).

format
string

Available formats are json, cof (see Common Output Format) or dig. Default format is based on the Accept HTTP header.

limit
number

Limit the number of results (e.g. limit=10000). Defaults to 100, and up to 50000.

offset
number

Used for pagination. Defaults to 0.