Products APIs Data Feeds Web Tools Domain Research & Monitoring Enterprise Packages AI Deep Research
WHOIS / WHOIS History
WHOIS / WHOIS History

Provide current and historical ownership information on domains / IPs. Identify all connections between domains, registrants, registrars, and DNS servers.

DNS / DNS History
DNS / DNS History

Look into all current and historical DNS / IP connections between domains and A, MX, NS, and other records. Monitor suspicious changes to DNS records.

IP Geolocation / IP Netblocks
IP Geolocation / IP Netblocks

Get detailed context on an IP address, including its user’s geolocation, time zone, connected domains, connection type, IP range, ASN, and other network ownership details.

Domain Research Suite (DRS)
Domain Research Suite (DRS)

Access our web-based solution to dig into and monitor all domain events of interest.

Domain Research Suite (DRS)
Domain Research Suite (DRS)

Get access to a web-based enterprise-grade solution to search and monitor domain registrations and ownership details for branded terms, fuzzy matches, registrants of interest, and more.

New gTLD Intelligence Services (NGIS)
New gTLD Intelligence Services (NGIS)

Independent, evidence-based DNS and abuse intelligence for applicants, advisors, governments, and counsel participating in the ICANN 2026 New gTLD Program.

Research
Monitoring
White-Label
Predictive Threat Intelligence Feeds
Predictive Threat Intelligence Feeds

Predictive threat intelligence is your best first line of defense. Subscribe to the feeds to strengthen your cybersecurity posture. Contact us today for more information.

WhoisXML API Internet Infrastructure
Internet Infrastructure

Unlock integrated intelligence on Internet properties and their ownership, infrastructure, and other attributes.

Enterprise API Packages
Enterprise API Packages

Our complete set of domain, IP, and DNS intelligence available via API calls as an annual subscription with predictable pricing.

Security Intelligence (SI) Suite
Security Intelligence (SI) Suite

Offers complete access to WHOIS, IP, DNS, and subdomain data for product enrichment, threat hunting and more.

Attack Surface Discovery API
Attack Surface Discovery API

Uncover entire attack surfaces with this API to embed asset discovery, vulnerability scanning, and technology metadata into your platform. Now in early access.

MCP Server
MCP Server

Talk to our APIs using LLMs. Connect your preferred LLM to WhoisXML API and simply chat about WHOIS, DNS, threat intelligence, and more.

Jake AI
Jake AI

I’m your Domain Intelligence Assistant. I make it easy to explore WHOIS, DNS, and threat data from WhoisXML API — I’m cloud-based, fast, and always ready to help.

WhoisXML API Domain Intelligence Advisor (via ChatGPT)
WhoisXML API Domain Intelligence Advisor (via ChatGPT)

A custom GPT for WHOIS, DNS, IP, and threat intelligence research. Connects ChatGPT directly to WhoisXML API to enable fast, conversational investigations and domain insights.

Discover what you really pay for when buying commercial Internet intelligence data.

Download now
×
Contact Us
API docs Integrations Pricing
Making requests Output format Error codes Server-to-Server OAuth
Balance information Generate new API key Resources
API 1.0 documentation

Output format

{
   "DNSData": {
      "domainName": "google.com",
      "types": [
         1,
         6,
         16
      ],
      "dnsTypes": "A,SOA,TXT",
      "audit": {
         "createdDate": "2019-05-07 14:45:22.916 UTC",
         "updatedDate": "2019-05-07 14:45:22.916 UTC"
      },
      "dnsRecords": [
         {
            "type": 16,
            "dnsType": "TXT",
            "name": "google.com.",
            "ttl": 299,
            "rRsetType": 16,
            "rawText": "google.com.\t\t299\tIN\tTXT\t\"globalsign-smime-dv=CDYX+XFHUw2wml6/Gb8+59BsH31KzUr6c1l2BPvqKX8=\"",
            "strings": [
               "globalsign-smime-dv=CDYX+XFHUw2wml6/Gb8+59BsH31KzUr6c1l2BPvqKX8="
            ]
         },
         {
            "type": 16,
            "dnsType": "TXT",
            "name": "google.com.",
            "ttl": 299,
            "rRsetType": 16,
            "rawText": "google.com.\t\t299\tIN\tTXT\t\"v=spf1 include:_spf.google.com ~all\"",
            "strings": [
               "v=spf1 include:_spf.google.com ~all"
            ]
         },
         {
            "type": 16,
            "dnsType": "TXT",
            "name": "google.com.",
            "ttl": 299,
            "rRsetType": 16,
            "rawText": "google.com.\t\t299\tIN\tTXT\t\"docusign=05958488-4752-4ef2-95eb-aa7ba8a3bd0e\"",
            "strings": [
               "docusign=05958488-4752-4ef2-95eb-aa7ba8a3bd0e"
            ]
         },
         {
            "type": 16,
            "dnsType": "TXT",
            "name": "google.com.",
            "ttl": 299,
            "rRsetType": 16,
            "rawText": "google.com.\t\t299\tIN\tTXT\t\"facebook-domain-verification=22rm551cu4k0ab0bxsw536tlds4h95\"",
            "strings": [
               "facebook-domain-verification=22rm551cu4k0ab0bxsw536tlds4h95"
            ]
         },
         {
            "type": 1,
            "dnsType": "A",
            "name": "google.com.",
            "ttl": 299,
            "rRsetType": 1,
            "rawText": "google.com.\t\t299\tIN\tA\t172.217.5.206",
            "address": "172.217.5.206"
         },
         {
            "type": 6,
            "dnsType": "SOA",
            "name": "google.com.",
            "ttl": 59,
            "rRsetType": 6,
            "rawText": "google.com.\t\t59\tIN\tSOA\tns1.google.com. dns-admin.google.com. 246997594 900 900 1800 60",
            "admin": "dns-admin.google.com.",
            "host": "ns1.google.com.",
            "expire": 1800,
            "minimum": 60,
            "refresh": 900,
            "retry": 900,
            "serial": 246997594
         }
      ]
   }
}

Output parameters

DNSData
The root element representing information about the domain's DNS records
domainName
The domain name being queried (e.g., google.com)
types
List of numeric DNS record types (e.g., A=1, SOA=6, TXT=16). Supported types are listed in the Supported DNS Types section. -1 indicates that all types are returned.
dnsTypes
Comma-separated list of DNS record types. _all indicates all types are returned.
audit
Audit information about when the data was created and updated
audit.createdDate
The timestamp when the data was created
audit.updatedDate
The timestamp when the data was last updated
dnsRecords
List of DNS records for the domain

Common DNS record fields

These fields are present on every record in dnsRecords regardless of type.

type
Numeric identifier for the DNS record type
dnsType
Textual representation of the DNS record type (e.g., A, AAAA, CNAME, MX, TXT, NS, SOA, CAA, PTR, SRV)
name
Domain or subdomain associated with the record
additionalName
The name used for additional data processing
ttl
Time-to-live (TTL) value in seconds
rRsetType
Numeric identifier for the resource record set type. Equal to type for all types except SIG/RRSIG.
rawText
Raw text representation of the DNS record in uncompressed DNS wire format

Type-specific output fields

Click a record type to expand its specific fields. These appear in addition to the common fields above.

A (1) — maps a domain name to an IPv4 address (RFC 1035)
address
The IPv4 address that the name refers to
A6 (38) — maps a domain name to an IPv6 address (historic, RFC 6563)
prefix
The name of the prefix
prefixBits
The number of bits in the address prefix
suffix
The address suffix
AAAA (28) — maps a domain name to an IPv6 address (RFC 3596)
address
The IPv6 address suffix
AFSDB (18) — maps a domain name to the name of an AFS cell database server (RFC 1183)
host
The host providing the service
subtype
Indicates the type of service provided by the host
APL (42) — Address Prefix List (RFC 3123)
elements
The list of APL elements
CAA (257) — Certification Authority Authorization (RFC 6844)
flags
The flags byte
tag
The tag (e.g., issue, issuewild, iodef)
value
The value associated with the tag
CERT (37) — stores a certificate associated with a name (RFC 4398)
algorithm
The algorithm of the associated KEYRecord, if present
cert
Binary data representing the certificate
certType
The type of certificate
keyTag
The ID of the associated KEYRecord, if present
CNAME (5) — maps an alias to its real name (RFC 1035)
alias
The name to which the CNAME alias points
target
The target of the CNAME record
DHCID (49) — Dynamic Host Configuration Protocol ID (RFC 4701)
data
Binary data, opaque to DNS
DLV (32769) — DNSSEC Lookaside Validation (RFC 4431)
algorithm
The original key algorithm
digest
A hash of the original key
digestID
The digest id code
footprint
The original KEY record's footprint (keyid)
DNAME (39) — maps a nonterminal alias (subtree) to a different domain (RFC 6672)
alias
The name to which the DNAME alias points
target
The target of the DNAME record
DS (43) — Delegation Signer (RFC 4034)
algorithm
The original key algorithm
digest
A hash of the original key
digestID
The digest id code
footprint
The original KEY record's footprint (keyid)
GPOS (27) — Geographical Location, withdrawn (RFC 1712)
altitude
The altitude component of the location, in meters above sea level
altitudeString
The altitude component as a string
latitude
The latitude component of the location
latitudeString
The latitude component as a string
longitude
The longitude component of the location
longitudeString
The longitude component as a string
HINFO (13) — Host Information; describes the CPU and OS of a host (RFC 1035)
cpu
A string describing the host's CPU
os
A string describing the host's OS
IPSECKEY (45) — IPsec Keying Material (RFC 4025)
algorithmType
The record's algorithm type
gateway
The record's gateway
gatewayType
The record's gateway type
ISDN (20) — identifies the ISDN number and subaddress associated with a name (RFC 1183)
address
The ISDN number associated with the domain
subAddress
The subaddress, if any
KX (36) — Key Exchange; delegation of authority (RFC 2230)
preference
The preference of this KX. Records with lower preference are preferred.
target
The host that authority is delegated to
LOC (29) — Location; describes the physical location of hosts, networks, subnets (RFC 1876)
altitude
The altitude of the center of the sphere, in meters
hPrecision
The horizontal precision of the data, in meters
latitude
The latitude of the center of the sphere
longitude
The longitude of the center of the sphere
size
The diameter of a sphere enclosing the described entity, in meters
vPrecision
The vertical precision of the data, in meters
MB (7) — Mailbox Record; specifies a host containing a mailbox (RFC 883)
mailbox
The host containing the mailbox for the domain
MD (3) — Mail Destination; obsolete (RFC 973)
mailAgent
The mail agent that delivers mail for the domain
MF (4) — Mail Forwarder; obsolete (RFC 973)
mailAgent
The mail agent that forwards mail for the domain
MG (8) — Mail Group; specifies a mailbox which is a member of a mail group (RFC 883)
mailbox
The mailbox that is a member of the group specified by the domain
MINFO (14) — Mailbox information (RFC 883)
errorAddress
The address to receive error messages relating to the mailing list/mailbox
responsibleAddress
The address responsible for the mailing list/mailbox
MR (9) — Mailbox Rename; specifies a rename of a mailbox (RFC 883)
newName
The new name of the mailbox specified by the domain
MX (15) — Mail Exchange (RFC 1035, RFC 7505)
priority
The priority of this MX. Records with lower priority are preferred.
target
The host that mail is sent to
NAPTR (35) — Name Authority Pointer (RFC 3403)
flags
The control aspects of the NAPTR record
order
The order of this NAPTR. Records with lower order are preferred.
preference
The preference, used to select between records at the same order
regexp
The regular/substitution expression
replacement
The domain name to query for the next DNS resource record, depending on the value of the flags field
service
The service or protocol available down the rewrite path
NS (2) — Name Server; contains the name server serving the named zone (RFC 1035)
target
The name server for the given domain
NSAP (22) — NSAP Address Record (RFC 1706)
address
The NSAP address
NSAP_PTR (23) — NSAP Pointer; obsolete (RFC 1706)
target
The name of the host with this address
NSEC (47) — Next SECure name (RFC 4034)
next
The following name in an ordered list of the zone
types
An array containing the types present
NSEC3 (50) — Next SECure name 3 (RFC 5155)
flags
The value of the flags field
hashAlgorithm
The hash algorithm
iterations
The number of hash iterations
next
The next hash (may not be null)
salt
The salt to use (may be null)
types
The types present at the original ownername
NSEC3PARAM (51) — Next SECure name 3 Parameters (RFC 5155)
flags
The value of the flags field
hashAlgorithm
The hash algorithm
iterations
The number of hash iterations
salt
The salt to use (may be null)
NULL (10) — holds arbitrary data (RFC 1035)
data
The contents of the record
NXT (30) — Next name (RFC 2065)
bitmap
The set of types for which records exist at this name
next
The following name in an ordered list of the zone
PTR (12) — Pointer Record; maps a name representing an Internet Address to a hostname (RFC 1035)
target
The name of the machine with this address
PX (26) — X.400 mail mapping record (RFC 2163)
map822
The RFC 822 component of the mail address
mapX400
The X.400 component of the mail address
preference
The preference of this mail address
RP (17) — Responsible Person (RFC 1183)
mailbox
The responsible person
textDomain
The address where TXT records can be found
RRSIG (46) — Resource Record Signature (RFC 4034)
algorithm
The cryptographic algorithm of the key that generated the signature
expire
The time at which the signature expires
footprint
The footprint/key id of the signing key
labels
The number of labels in the signed domain name
origTTL
The original TTL of the RRset
signature
Binary data representing the signature
signer
The owner of the signing key
timeSigned
The time at which this signature was generated
typeCovered
The RRset type covered by this signature
RT (21) — Route Through (RFC 1035)
intermediateHost
The domain name of the host to use as a router
preference
The preference of the route. Smaller numbers indicate more preferred routes.
SIG (24) — Signature (RFC 2535)
algorithm
The cryptographic algorithm of the key that generated the signature
expire
The time at which the signature expires
footprint
The footprint/key id of the signing key
labels
The number of labels in the signed domain name
origTTL
The original TTL of the RRset
signature
Binary data representing the signature
signer
The owner of the signing key
timeSigned
The time at which this signature was generated
typeCovered
The RRset type covered by this signature
SOA (6) — Start of Authority; describes properties of a zone (RFC 1035)
admin
The zone administrator's address
expire
The amount of time until a secondary expires a zone, in seconds
host
The primary name server for the zone
minimum
The minimum TTL for records in the zone, used as the default TTL for negative caching
refresh
The amount of time until a secondary checks for a new serial number, in seconds
retry
The amount of time between a secondary's checks for a new serial number, in seconds
serial
The zone's serial number
SRV (33) — Server Selection Record (RFC 2782)
port
The TCP/UDP port that the service uses
priority
The priority of this SRV. Records with lower priority are preferred.
target
The host running the service
weight
The weight, used to select between records at the same priority
SSHFP (44) — SSH Fingerprint; stores the fingerprint of an SSH host key (RFC 4255)
—
SSHFP records carry only the common DNS record fields listed above; no additional type-specific attributes.
TLSA (52) — Transport Layer Security Authentication / DANE (RFC 6698)
certificateAssociationData
The "certificate association data" to be matched
certificateUsage
The provided association used to match the certificate presented in the TLS handshake
matchingType
How the certificate association is presented
selector
The part of the TLS certificate presented by the server that will be matched against the association data
TXT (16) — stores text strings (RFC 1035)
strings
The text strings
WKS (11) — Well Known Services; lists services offered by this host (RFC 1035)
address
The IP address
protocol
The IP protocol number
services
An array of supported services, represented by port number
X25 (19) — identifies the PSDN (Public Switched Data Network) address in the X.121 numbering plan (RFC 1183)
address
The X.25 PSDN address