> ## Documentation Index
> Fetch the complete documentation index at: https://docs.infrawatch.com/llms.txt
> Use this file to discover all available pages before exploring further.

# DNS fields

> Search fields for current open passive-DNS segments

Search fields for current open passive-DNS segments.

Dataset: `dns`

<ResponseField name="dns" type="object">
  <Expandable title="Fields">
    <ResponseField name="answer" type="string">
      Renderable answer value; IP answers are normalized to printable IP strings, other answers use answer\_text. Friendly label: `DNS Answer`. Operators: `:` `=` `!=` `=~` `:~`.
    </ResponseField>

    <ResponseField name="answer_ip" type="ip">
      IP answer value for A/AAAA-style records. Friendly label: `DNS Answer IP`. Operators: `:` `=` `!=`.
    </ResponseField>

    <ResponseField name="answer_kind" type="string">
      Normalized answer kind such as ip4, ip6, cname, hostname, or txt. Friendly label: `DNS Answer Kind`. Operators: `:` `=` `!=` `=~` `:~`.
    </ResponseField>

    <ResponseField name="answer_text" type="string">
      Text answer value for non-IP answers. Friendly label: `DNS Answer Text`. Operators: `:` `=` `!=` `=~` `:~`.
    </ResponseField>

    <ResponseField name="apex_domain" type="string">
      Registered/apex domain for the queried DNS hostname. Friendly label: `DNS Apex Domain`. Operators: `:` `=` `!=` `=~` `:~`.
    </ResponseField>

    <ResponseField name="first_seen" type="timestamp">
      First time this open DNS segment was observed. Operators: `:` `=` `!=` `<` `<=` `>` `>=`.
    </ResponseField>

    <ResponseField name="host" type="string">
      Queried DNS hostname. Short helpers domain:, fqdn:, hostname:, and qname: compile to this field. Friendly label: `DNS Host`. Operators: `:` `=` `!=` `=~` `:~`.
    </ResponseField>

    <ResponseField name="rcode" type="string">
      DNS response code for the open segment. Friendly label: `DNS Response Code`. Operators: `:` `=` `!=` `=~` `:~`.
    </ResponseField>

    <ResponseField name="tld" type="string">
      Public suffix/TLD for the queried DNS hostname. Friendly label: `DNS TLD`. Operators: `:` `=` `!=` `=~` `:~`.
    </ResponseField>

    <ResponseField name="type" type="string">
      DNS query type, for example A, AAAA, CNAME, MX, TXT, or NS. Friendly label: `DNS Type`. Operators: `:` `=` `!=` `=~` `:~`.
    </ResponseField>
  </Expandable>
</ResponseField>