Skip to main content
Passive DNS connects names to the answers Infrawatch observed. Use it to expand an investigation without treating a historical relationship as a current fact.

​
Start from an IP address

Find names observed returning an address:
Useful response fields:
  • host: the queried DNS name.
  • record_type: the DNS record type.
  • answer and answer_ip: the observed answer.
  • first_seen_at and last_seen_at: UTC dates bounding the observation.
  • has_dangling_finding: whether Infrawatch attached a dangling-DNS finding.

​
Start from a domain

List distinct current DNS names below a domain:
The response returns a subdomains string array and the shared pagination object. When has_more is true, pass next_cursor as cursor on the next request. The total is a lower bound until the final page. Search one hostname:
Search the registered domain and its observed names:
Use the subdomain endpoint for fast name discovery, host for one precise name, and dns.apex_domain when you need complete DNS records for a registered domain.

​
Narrow the relationship

Combine DNS fields with InfraQL: Field availability and operators are defined in the Data Dictionary.

​
Interpret dates carefully

DNS results expose dates rather than timestamps:
  • first_seen_at is the first UTC day Infrawatch observed the open DNS segment.
  • last_seen_at is the most recent observed UTC day.
  • If no later observation exists, last_seen_at equals first_seen_at.
These dates describe Infrawatch observations. They do not prove when the DNS record was created or removed at the authoritative provider.

​
Pivot back to infrastructure

Once a DNS answer gives you an address, inspect it as a host:

Investigate the resulting IP

Add network attribution, exposed services, tags, and reporting to the DNS relationship.