> ## Documentation Index
> Fetch the complete documentation index at: https://docs.infrawatch.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Pivot through passive DNS

> Move between domains and IP addresses using observed DNS relationships

Passive DNS connects names to the answers Infrawatch observed. Use it to expand
an investigation without treating a historical relationship as a current fact.

## Start from an IP address

Find names observed returning an address:

```bash theme={null}
curl --get "https://api.infrawatch.com/api/v1/search/dns" \
  --header "X-API-Key: ${INFRAWATCH_API_KEY}" \
  --data-urlencode "q=answer_ip:1.1.1.1" \
  --data "limit=100"
```

Useful response fields:

* `host`: the queried DNS name.
* `record_type`: the DNS record type.
* `answer` and `answer_ip`: the observed answer.
* `first_seen_at` and `last_seen_at`: UTC dates bounding the observation.
* `has_dangling_finding`: whether Infrawatch attached a dangling-DNS finding.

## Start from a domain

List distinct current DNS names below a domain:

```bash theme={null}
curl --get "https://api.infrawatch.com/api/v1/search/dns/subdomains" \
  --header "X-API-Key: ${INFRAWATCH_API_KEY}" \
  --data-urlencode "domain=example.com" \
  --data "limit=100"
```

The response returns a `subdomains` string array and the shared `pagination`
object. When `has_more` is true, pass `next_cursor` as `cursor` on the next
request. The total is a lower bound until the final page.

Search one hostname:

```bash theme={null}
curl --get "https://api.infrawatch.com/api/v1/search/dns" \
  --header "X-API-Key: ${INFRAWATCH_API_KEY}" \
  --data-urlencode "q=host:example.com" \
  --data "limit=100"
```

Search the registered domain and its observed names:

```bash theme={null}
curl --get "https://api.infrawatch.com/api/v1/search/dns" \
  --header "X-API-Key: ${INFRAWATCH_API_KEY}" \
  --data-urlencode "q=dns.apex_domain:example.com" \
  --data "limit=100"
```

<Tip>
  Use the subdomain endpoint for fast name discovery, `host` for one precise
  name, and `dns.apex_domain` when you need complete DNS records for a registered
  domain.
</Tip>

## Narrow the relationship

Combine DNS fields with InfraQL:

| Goal                            | Query                             |
| ------------------------------- | --------------------------------- |
| A records for one name          | `host:example.com AND dns.type:A` |
| Names pointing to an address    | `answer_ip:1.1.1.1`               |
| CNAME observations              | `dns.type:CNAME`                  |
| Successful responses            | `dns.rcode:NOERROR`               |
| Recently first observed records | `dns.first_seen>=2026-07-01`      |

Field availability and operators are defined in the [Data Dictionary](/data-dictionary#dns).

## Interpret dates carefully

DNS results expose dates rather than timestamps:

* `first_seen_at` is the first UTC day Infrawatch observed the open DNS segment.
* `last_seen_at` is the most recent observed UTC day.
* If no later observation exists, `last_seen_at` equals `first_seen_at`.

These dates describe Infrawatch observations. They do not prove when the DNS
record was created or removed at the authoritative provider.

## Pivot back to infrastructure

Once a DNS answer gives you an address, inspect it as a host:

```bash theme={null}
curl --get "https://api.infrawatch.com/api/v1/search/hosts" \
  --header "X-API-Key: ${INFRAWATCH_API_KEY}" \
  --data-urlencode "q=ip:1.1.1.1" \
  --data "limit=1"
```

<Card title="Investigate the resulting IP" icon="https://mintcdn.com/infrawatch/hFIgmGIh7O3VGQHG/images/products/investigate.svg?fit=max&auto=format&n=hFIgmGIh7O3VGQHG&q=85&s=07af7d2d72ee29e21a6f8df34da95847" href="/use-cases/investigate-an-ip" width="32" height="32" data-path="images/products/investigate.svg">
  Add network attribution, exposed services, tags, and reporting to the DNS
  relationship.
</Card>