DNS History API
List the DNS Values a Name Has Had and When We Saw Them.
Pass a domain or hostname, and a record type if you want only one. The API returns the distinct values Deepinfo has observed for it, including values that have since changed or been removed, each with the list of times it was seen.
A records
acme.example
-
203.0.113.10stoppedAug 16 to Sep 5 2026
: seen 2026-09-05, 2026-08-27, 2026-08-16 (newest first). -
198.51.100.24startedSep 9 to Sep 18 2026
: seen 2026-09-18, 2026-09-14, 2026-09-09 (newest first).
Follow One Name’s Records Over Time.
Values are grouped by record type, and each value carries its own observation times. A change shows up where one value’s sightings stop and the next value’s begin.
| Parameter | Type | Description | |
|---|---|---|---|
domain | string | Required | A domain or hostname, for example deepinfo.com or www.deepinfo.com. IP addresses are not accepted. |
type | string | Optional | One record type, such as A, AAAA, MX, NS, SOA or TXT. Leave it out to get every type. |
Request
curl "https://api.deepinfo.com/v1/analyze/dns-history?domain=deepinfo.com&type=A" \
-H "apikey: YOUR_API_KEY"import requests
r = requests.get(
"https://api.deepinfo.com/v1/analyze/dns-history",
params={"domain": "deepinfo.com", "type": "A"},
headers={"apikey": "YOUR_API_KEY"},
)
for rec in r.json()["records"]:
for v in rec["values"]:
# times are newest first
print(rec["type"], v["value"], v["time"][-1], v["time"][0])const r = await fetch(
'https://api.deepinfo.com/v1/analyze/dns-history?domain=deepinfo.com&type=A',
{ headers: { apikey: 'YOUR_API_KEY' } }
)
const { records } = await r.json()
for (const rec of records)
for (const v of rec.values) console.log(rec.type, v.value, v.time.at(-1), v.time[0])Response
{
"fqdn": "deepinfo.com",
"dn": "deepinfo.com",
"subdomain": null,
"records": [
{
"type": "a",
"values": [
{
"value": "104.26.10.21",
"time": [
"2026-09-18T05:41:26Z",
"2026-09-05T21:26:18Z",
"2026-08-16T16:37:59Z"
]
},
{
"value": "172.67.70.198",
"time": ["2026-09-18T05:41:26Z", "…"]
},
"…"
]
}
]
}When Today’s Answer Is Not Enough.
Incident Investigation
Find what a hostname pointed at on the day of the incident, not only what it points at today.
Threat Hunting
Follow suspicious infrastructure as it moves between addresses, mail servers and name servers.
Domain Research
See when a domain changed hosting, mail or DNS provider, and what it used before.
Timestamps, Types and Your Assets.
| Record types | type is lower case in the response, for example a or mx. |
|---|---|
| Timestamps | Each value’s time list is in UTC and newest first: time[0] is the latest sighting, the last entry the earliest. |
| Your assets | For assets you monitor in External Attack Surface Management, each DNS snapshot is also kept per asset, next to that asset’s WHOIS, SSL and port scan history. |
| Rate limits | Plan-dependent. The default is one request per second per key and endpoint. See rate limits. |
| Errors | 400 when domain is not a valid name. See errors. |
Questions About DNS History API
How far back does the history go?
It depends on the name. The response holds all values Deepinfo has observed for it, so the oldest time in the time lists is the earliest observation the index holds.
Can we query a hostname instead of a domain?
Yes, for example www.deepinfo.com. The response names its registered domain in dn and the subdomain part in subdomain, which is null for a domain.
Can we find every name that pointed to an IP address?
Use Domain Search on ip_ or domain.ip_. Both hold each address a name has resolved to over time, so the filter also finds names that have since moved.
Can we pull DNS history for many names at once?
Not through a public endpoint: this call answers for one name. For many names, see Historical DNS Records and tell our data team what your analysis needs.
How is the DNS History API priced?
As part of an API services plan, priced by volume and frequency, separately from the platform. See Data & API pricing or talk to us.
Can analysts read DNS history without writing code?
Yes. Instant Lookups shows DNS History in the Deepinfo Platform, next to the live DNS lookup.
Trace a Name You Already Know.
Pull the history of one of your domains first and check it against what you remember changing. We set up access and answer schema questions on a short call.