> ## Documentation Index
> Fetch the complete documentation index at: https://docs.infrawatch.com/llms.txt
> Use this file to discover all available pages before exploring further.

# DNS

> Trace observed relationships between names and internet addresses

Infrawatch passive DNS records connect a queried name to the answer observed at
a point in time. Use DNS to expand an investigation beyond a current IP address
or recover infrastructure from an earlier observation.

## What DNS gives you

* **Forward and reverse pivots** - Move from a hostname to its answers or from
  an IP address back to observed names.
* **Subdomain discovery** - List distinct current DNS owner names below a
  domain without writing an InfraQL expression.
* **Observation dates** - See when a relationship was first and last observed.
* **Typed records** - Filter A, AAAA, CNAME, MX, NS, TXT, and other record
  types.
* **Modern record types** - Query the newer records that carry real
  configuration, including `HTTPS` and `SVCB` service bindings, rather than
  stopping at the classic set.
* **Normalized answers** - Query IP and textual answers through dedicated
  fields.
* **Dangling-DNS context** - Identify records associated with a dangling
  finding.

## Start an investigation

Find names observed pointing to an IP:

```text theme={null}
answer_ip:1.1.1.1
```

Find recent CNAME observations for a domain:

```text theme={null}
type:CNAME AND host:*.example.com AND first_seen>=now-30d
```

List current subdomains:

```bash theme={null}
curl --get "https://api.infrawatch.com/api/v1/search/dns/subdomains" \
  --header "X-API-Key: ${INFRAWATCH_API_KEY}" \
  --data-urlencode "domain=example.com" \
  --data "limit=100"
```

<CardGroup cols={2}>
  <Card title="Pivot through passive DNS" icon="https://mintcdn.com/infrawatch/hFIgmGIh7O3VGQHG/images/products/dns.svg?fit=max&auto=format&n=hFIgmGIh7O3VGQHG&q=85&s=47a48af3a654f274eadb1754689f8dc4" href="/use-cases/pivot-through-passive-dns" width="32" height="32" data-path="images/products/dns.svg">
    Follow a complete domain-to-IP investigation.
  </Card>

  <Card title="Browse DNS fields" icon="https://mintcdn.com/infrawatch/gCEz_Bv1hOrMPG8n/images/products/data-dictionary.svg?fit=max&auto=format&n=gCEz_Bv1hOrMPG8n&q=85&s=7610d618bf3603732c6f9102b62101df" href="/data-dictionary/dns" width="32" height="32" data-path="images/products/data-dictionary.svg">
    Inspect record fields, meanings, and supported operators.
  </Card>
</CardGroup>