The DNS records behind every domain.
Each domain's A, AAAA, MX, NS and CNAME records, a file per record type: the IPv4 and IPv6 addresses its names resolve to with CNAMEs followed, its mail exchangers with their priorities, the nameservers it is delegated to, and every CNAME with the name it points to. Rebuilt weekly.
Schema at a glance.
See documentation →The schema and metadata are in the docs. It is published as CSVGZ.
| name | ip | last_seen |
|---|---|---|
| advosapp.com | 85.222.164.27 | 2026-10-14 |
| beardbrews.com | 3.33.251.168 | 2026-10-10 |
| class-l.jp | 54.192.35.117 | 2026-10-11 |
| huddingefk.blog | 192.0.78.25 | 2026-10-10 |
| www.buybuy-center.com | 198.185.159.144 | 2026-10-11 |
The IPv6 addresses.
Domain DNS AAAA is the same shape as the A file, one row per name and IPv6 address, with CNAMEs followed. A www name has rows only where its addresses differ from its domain's. It is licensed and downloaded on its own.
| name | ip | last_seen |
|---|---|---|
| bail.org | 2a01:7e01::f03c:95ff:feed:783e | 2026-10-12 |
| brilliancewires.tech | 2607:f1c0:100f:f000::200 | 2026-10-10 |
| charlie-cloud.net | 2606:4700:3030::ac43:99c5 | 2026-10-11 |
| download.gls-italy.com | 2600:9000:20a5:c400:1f:73ec:ecc0:93a1 | 2026-10-11 |
| www.clairite.com | 2620:127:f00f:e:: | 2026-10-10 |
Where each domain's mail goes.
Domain DNS MX lists each domain's mail exchangers, one row per record, with the priority a sender tries them in. A host of . is a null MX: the domain says it accepts no mail. It is licensed and downloaded on its own.
| name | priority | host | last_seen |
|---|---|---|---|
| anyauto.com | 10 | cluster2.us.messagelabs.com | 2026-10-11 |
| artekolsanat.xyz | 0 | . | 2026-10-13 |
| clabcomunicazione.it | 10 | alt3.aspmx.l.google.com | 2026-10-10 |
| damoradigital.com | 10 | mail.damoradigital.com | 2026-10-12 |
| ezytracks.info | 10 | mx00.ionos.com | 2026-10-11 |
Who serves each domain's DNS.
Domain DNS NS lists the nameservers each domain is delegated to, one row per nameserver. It is licensed and downloaded on its own.
| name | host | last_seen |
|---|---|---|
| 24store.surf | maceio.ns.porkbun.com | 2026-10-12 |
| co-ltd.biz | ns1.xserver.jp | 2026-10-12 |
| daichiboxltd.com | nsb1.squarespacedns.com | 2026-10-12 |
| geeks4ever.com | ns55.domaincontrol.com | 2026-10-12 |
| hotshop.dev | carla.ns.cloudflare.com | 2026-10-12 |
Every alias, and what it points to.
Domain DNS CNAME lists every CNAME record, one row per alias and target, each hop of a chain its own row, so a chain can be followed from name to name to the platform a site runs on. It is licensed and downloaded on its own.
| name | target | last_seen |
|---|---|---|
| log31-normal-useast1a.tiktokv.com | api39.gtm.byteoversea.net | 2026-10-10 |
| www.acrecandleco.com | shops.myshopify.com | 2026-10-14 |
| www.compostify.org | compostify.org | 2026-10-12 |
| www.dealtechla.com | parkingpage.namecheap.com | 2026-10-10 |
| www.end287g.com | ghs.googlehosted.com | 2026-10-12 |
Downloading it from code.
Database API reference →One call gets you the current Domain DNS build. Every official client wraps it three ways: straight to disk, a time-limited link you hand to your own runner, or bytes in memory, and checksums() returns the published digests to verify it against.
download()downloadUrl()downloadBytes()metadata()checksums()import osfrom internetdata import InternetDataclient = InternetData(os.environ["INTERNETDATA_API_KEY"])# what is in today's build, without moving the filemeta = client.database.metadata("domain_dns_a_v1")client.database.download("domain_dns_a_v1", "csvgz", "./domain_dns_a_v1.csv.gz")sums = client.database.checksums("domain_dns_a_v1", "csvgz")print(meta.updated, meta.entries, sums["sha256"])
Getting your hands on it.
Teams match Domain DNS against the names they already see, inside their own infrastructure, and never send a name anywhere to get an answer.
Platform and provider mapping
Read which host, CDN, mail provider or website builder a domain runs on from its addresses, MX records, nameservers and CNAMEs.
Threat investigation
Pivot from an address or nameserver to the other domains that share it, without a resolver query that tips anyone off.
Domains by address
Join the A and AAAA files on ip to see every domain an address of yours, or a customer's, serves.
An official client for every major language.
All SDKs on GitHub →Twelve official clients for the languages you ship in, each wrapping the database endpoints: list what you're licensed for, poll a build, follow the download redirect and verify what landed. Install commands are in the docs.
Why is there a file per record type?
So you take the records you need: each type is its own download and license, and every file is keyed by the same name column, so they join on it.
Are CNAMEs followed?
Yes, in the A, AAAA and MX files: a name under a CNAME lists the addresses or mail exchangers its chain ends at. The CNAME file lists each hop as its own row, so a chain can be followed from name to name.
Are www names in it?
In the CNAME file, all of them. In the A and AAAA files, a www name has rows only where its addresses differ from its domain's, so a domain whose www resolves to the same addresses has rows for the domain alone.
What does a host of . mean in the MX file?
A null MX: the domain publishes that it accepts no mail (RFC 7505).
Which names are in it?
Domains registered under the generic top-level domains and their www names, and widely used names under country-code domains such as .uk and .de. Names are lowercase, internationalized ones in punycode.
How often is it rebuilt?
Weekly. The metadata call answers when the current build landed and how many rows it holds, before you fetch it.
Which formats does a build ship in?
Gzipped CSV. It's keyed by name, so there is no address lookup to build. Poll the metadata call first and fetch only when the build has changed.
What if a row looks wrong?
Send it to us and we'll tell you what we hold on it, when we last saw it and how. Corrections land in the next build.
Test the real build first.
An evaluation license puts a full current build in your hands, with no sampling, so you can measure it against your own traffic before anyone talks about terms.