Farsight DNSDB

flex search method (regex - regular expression search, glob - full wildcarding)

search key

Query value

Provide results before the defined timestamp for when the DNS record was first observed. For example, the URL parameter 'time_first_before=1420070400' will only provide matching DNS records that were first observed before (or older than) January 1, 2015.

Provide results after the defined timestamp for when the DNS record was first observed. For example, the URL parameter 'time_first_after=-31536000' will only provide results that were first observed within the last year.

Provide results before the defined timestamp for when the DNS record was last observed. For example, the URL parameter 'time_last_before=1356998400' will only provide results for DNS records that were last observed before 2013.

Provide results after the defined timestamp for when the DNS record was last observed. For example, the URL parameter 'time_last_after=-2678400' will only provide results that were last observed after 31 days ago.

Limit for the number of results returned via these lookup methods. There is a built-in limit to the number of results that are returned via these lookup methods. The default limit is set at 10,000. This limit can be raised or lowered by setting the 'limit' query parameter. There is also a maximum number of results allowed; requesting a limit greater than the maximum will only return the maximum. See results_max below for information on that maximum. If '?limit=0' is used then DNSDB will return the maximum number of results allowed. If there are less results for the query than the requested limit, only the actual amount can be returned.

The 'exclude' parameter is used to exclude (i.e. filter-out) results that match it. It is described below this table.

How many rows to offset (e.g. skip) in the results. This implements an incremental result transfer feature, allowing you to view more of the available results for a single query. The rows are offset prior to the limit parameter being applied, therefore offset allows seeing additional results past a limit that matches the maximum number of results. Note that DNSDB recalculates the results for each query and the order of results might not be preserved. Therefore, this capability is not a valid way to walk all results over multiple queries - some results might be missing and some might be duplicated. The actual offset that can be used is limited or for certain API keys, offset is not allowed - see the offset_max rate_limit key below. The offset value must be a positive integer. The default is 0, which means do not offset the rows.

Query type(name, raw) name: The VALUE is a DNS domain name in presentation format, or a left-hand ('c.example.com') or right-hand ('www.example.') wildcard domain name. Note that left-hand wildcard queries are somewhat more expensive than right-hand wildcard queries.,ip: The VALUE is one of an IPv4 or IPv6 single address, with a prefix length, or with an address range. If a prefix is provided, the delimiter between the network address and prefix length is a single comma (',') character rather than the usual slash ('/') character to avoid clashing with the HTTP URI path name separator., raw: The VALUE is an even number of hexadecimal digits specifying a raw octet string.

Query value

Provide results before the defined timestamp for when the DNS record was first observed. For example, the URL parameter 'time_first_before=1420070400' will only provide matching DNS records that were first observed before (or older than) January 1, 2015.

Provide results after the defined timestamp for when the DNS record was first observed. For example, the URL parameter 'time_first_after=-31536000' will only provide results that were first observed within the last year.

Provide results before the defined timestamp for when the DNS record was last observed. For example, the URL parameter 'time_last_before=1356998400' will only provide results for DNS records that were last observed before 2013.

Provide results after the defined timestamp for when the DNS record was last observed. For example, the URL parameter 'time_last_after=-2678400' will only provide results that were last observed after 31 days ago.

Limit for the number of results returned via these lookup methods. There is a built-in limit to the number of results that are returned via these lookup methods. The default limit is set at 10,000. This limit can be raised or lowered by setting the 'limit' query parameter. There is also a maximum number of results allowed; requesting a limit greater than the maximum will only return the maximum. See results_max below for information on that maximum. If '?limit=0' is used then DNSDB will return the maximum number of results allowed. If there are less results for the query than the requested limit, only the actual amount can be returned.

Aggregated results group identical rrsets across all time periods and is the classic behavior from querying the DNSDB. This means you could get the total number of times an rrset has been observed, but not when it was observed. Unaggregated results ungroup identical rrsets, allowing you to see how the domain name was resolved in the DNS across the full-time range covered in DNSDB (subject to time fencing). This can give a more accurate impression of record request volume across time because it will reveal the distinct timestamps of records whose values are repeated. You can answer questions like, 'Was a domain parked for a long time, mostly unused, until it was repurposed for serving malware or relaying spam, but then was abandoned again?' It allows you to see if a record was observed heavily in the last week vs. having been observed constantly for years. This is a boolean value. Use True, the default, for the aggregated results or False for unaggregated results.

A boolean value that is True if time values (in time_first, time_last, zone_time_first, zone_time_last) should be returned in human readable (RFC3339 compliant) format or False if Unix-style time values in seconds since the epoch should be returned. False is the classic behavior from querying the DNSDB and is the default value for this option.

How many rows to offset (e.g. skip) in the results. This implements an incremental result transfer feature, allowing you to view more of the available results for a single query. The rows are offset prior to the limit parameter being applied, therefore offset allows seeing additional results past a limit that matches the maximum number of results. Note that DNSDB recalculates the results for each query and the order of results might not be preserved. Therefore, this capability is not a valid way to walk all results over multiple queries - some results might be missing and some might be duplicated. The actual offset that can be used is limited or for certain API keys, offset is not allowed - see the offset_max rate_limit key below. The offset value must be a positive integer. The default is 0, which means do not offset the rows.

Query type(name, raw) name: The VALUE is a DNS domain name in presentation format, or a left-hand ('c.example.com') or right-hand ('www.example.') wildcard domain name. Note that left-hand wildcard queries are somewhat more expensive than right-hand wildcard queries.,ip: The VALUE is one of an IPv4 or IPv6 single address, with a prefix length, or with an address range. If a prefix is provided, the delimiter between the network address and prefix length is a single comma (',') character rather than the usual slash ('/') character to avoid clashing with the HTTP URI path name separator., raw: The VALUE is an even number of hexadecimal digits specifying a raw octet string.

Query value

Query rrtype

Provide results before the defined timestamp for when the DNS record was first observed. For example, the URL parameter 'time_first_before=1420070400' will only provide matching DNS records that were first observed before (or older than) January 1, 2015.

Provide results after the defined timestamp for when the DNS record was first observed. For example, the URL parameter 'time_first_after=-31536000' will only provide results that were first observed within the last year.

Provide results before the defined timestamp for when the DNS record was last observed. For example, the URL parameter 'time_last_before=1356998400' will only provide results for DNS records that were last observed before 2013.

Provide results after the defined timestamp for when the DNS record was last observed. For example, the URL parameter 'time_last_after=-2678400' will only provide results that were last observed after 31 days ago.

Limit for the number of results returned via these lookup methods. There is a built-in limit to the number of results that are returned via these lookup methods. The default limit is set at 10,000. This limit can be raised or lowered by setting the 'limit' query parameter. There is also a maximum number of results allowed; requesting a limit greater than the maximum will only return the maximum. See results_max below for information on that maximum. If '?limit=0' is used then DNSDB will return the maximum number of results allowed. If there are less results for the query than the requested limit, only the actual amount can be returned.

Aggregated results group identical rrsets across all time periods and is the classic behavior from querying the DNSDB. This means you could get the total number of times an rrset has been observed, but not when it was observed. Unaggregated results ungroup identical rrsets, allowing you to see how the domain name was resolved in the DNS across the full-time range covered in DNSDB (subject to time fencing). This can give a more accurate impression of record request volume across time because it will reveal the distinct timestamps of records whose values are repeated. You can answer questions like, 'Was a domain parked for a long time, mostly unused, until it was repurposed for serving malware or relaying spam, but then was abandoned again?' It allows you to see if a record was observed heavily in the last week vs. having been observed constantly for years. This is a boolean value. Use True, the default, for the aggregated results or False for unaggregated results.

A boolean value that is True if time values (in time_first, time_last, zone_time_first, zone_time_last) should be returned in human readable (RFC3339 compliant) format or False if Unix-style time values in seconds since the epoch should be returned. False is the classic behavior from querying the DNSDB and is the default value for this option.

How many rows to offset (e.g. skip) in the results. This implements an incremental result transfer feature, allowing you to view more of the available results for a single query. The rows are offset prior to the limit parameter being applied, therefore offset allows seeing additional results past a limit that matches the maximum number of results. Note that DNSDB recalculates the results for each query and the order of results might not be preserved. Therefore, this capability is not a valid way to walk all results over multiple queries - some results might be missing and some might be duplicated. The actual offset that can be used is limited or for certain API keys, offset is not allowed - see the offset_max rate_limit key below. The offset value must be a positive integer. The default is 0, which means do not offset the rows.

Query type(name, raw) name: The VALUE is a DNS owner name in presentation format or wildcards as described below. We sometimes call this just an rrset search, raw: The VALUE is an even number of hexadecimal digits specifying a raw octet string.

Query value

Provide results before the defined timestamp for when the DNS record was first observed. For example, the URL parameter 'time_first_before=1420070400' will only provide matching DNS records that were first observed before (or older than) January 1, 2015.

Provide results after the defined timestamp for when the DNS record was first observed. For example, the URL parameter 'time_first_after=-31536000' will only provide results that were first observed within the last year.

Provide results before the defined timestamp for when the DNS record was last observed. For example, the URL parameter 'time_last_before=1356998400' will only provide results for DNS records that were last observed before 2013.

Provide results after the defined timestamp for when the DNS record was last observed. For example, the URL parameter 'time_last_after=-2678400' will only provide results that were last observed after 31 days ago.

Limit for the number of results returned via these lookup methods. There is a built-in limit to the number of results that are returned via these lookup methods. The default limit is set at 10,000. This limit can be raised or lowered by setting the 'limit' query parameter. There is also a maximum number of results allowed; requesting a limit greater than the maximum will only return the maximum. See results_max below for information on that maximum. If '?limit=0' is used then DNSDB will return the maximum number of results allowed. If there are less results for the query than the requested limit, only the actual amount can be returned.

Aggregated results group identical rrsets across all time periods and is the classic behavior from querying the DNSDB. This means you could get the total number of times an rrset has been observed, but not when it was observed. Unaggregated results ungroup identical rrsets, allowing you to see how the domain name was resolved in the DNS across the full-time range covered in DNSDB (subject to time fencing). This can give a more accurate impression of record request volume across time because it will reveal the distinct timestamps of records whose values are repeated. You can answer questions like, 'Was a domain parked for a long time, mostly unused, until it was repurposed for serving malware or relaying spam, but then was abandoned again?' It allows you to see if a record was observed heavily in the last week vs. having been observed constantly for years. This is a boolean value. Use True, the default, for the aggregated results or False for unaggregated results.

A boolean value that is True if time values (in time_first, time_last, zone_time_first, zone_time_last) should be returned in human readable (RFC3339 compliant) format or False if Unix-style time values in seconds since the epoch should be returned. False is the classic behavior from querying the DNSDB and is the default value for this option.

How many rows to offset (e.g. skip) in the results. This implements an incremental result transfer feature, allowing you to view more of the available results for a single query. The rows are offset prior to the limit parameter being applied, therefore offset allows seeing additional results past a limit that matches the maximum number of results. Note that DNSDB recalculates the results for each query and the order of results might not be preserved. Therefore, this capability is not a valid way to walk all results over multiple queries - some results might be missing and some might be duplicated. The actual offset that can be used is limited or for certain API keys, offset is not allowed - see the offset_max rate_limit key below. The offset value must be a positive integer. The default is 0, which means do not offset the rows.

Query type(name, raw) name: The VALUE is a DNS owner name in presentation format or wildcards as described below. We sometimes call this just an rrset search, raw: The VALUE is an even number of hexadecimal digits specifying a raw octet string.

Query value

Query rrtype

Provide results before the defined timestamp for when the DNS record was first observed. For example, the URL parameter 'time_first_before=1420070400' will only provide matching DNS records that were first observed before (or older than) January 1, 2015.

Provide results after the defined timestamp for when the DNS record was first observed. For example, the URL parameter 'time_first_after=-31536000' will only provide results that were first observed within the last year.

Provide results before the defined timestamp for when the DNS record was last observed. For example, the URL parameter 'time_last_before=1356998400' will only provide results for DNS records that were last observed before 2013.

Provide results after the defined timestamp for when the DNS record was last observed. For example, the URL parameter 'time_last_after=-2678400' will only provide results that were last observed after 31 days ago.

Limit for the number of results returned via these lookup methods. There is a built-in limit to the number of results that are returned via these lookup methods. The default limit is set at 10,000. This limit can be raised or lowered by setting the 'limit' query parameter. There is also a maximum number of results allowed; requesting a limit greater than the maximum will only return the maximum. See results_max below for information on that maximum. If '?limit=0' is used then DNSDB will return the maximum number of results allowed. If there are less results for the query than the requested limit, only the actual amount can be returned.

Aggregated results group identical rrsets across all time periods and is the classic behavior from querying the DNSDB. This means you could get the total number of times an rrset has been observed, but not when it was observed. Unaggregated results ungroup identical rrsets, allowing you to see how the domain name was resolved in the DNS across the full-time range covered in DNSDB (subject to time fencing). This can give a more accurate impression of record request volume across time because it will reveal the distinct timestamps of records whose values are repeated. You can answer questions like, 'Was a domain parked for a long time, mostly unused, until it was repurposed for serving malware or relaying spam, but then was abandoned again?' It allows you to see if a record was observed heavily in the last week vs. having been observed constantly for years. This is a boolean value. Use True, the default, for the aggregated results or False for unaggregated results.

A boolean value that is True if time values (in time_first, time_last, zone_time_first, zone_time_last) should be returned in human readable (RFC3339 compliant) format or False if Unix-style time values in seconds since the epoch should be returned. False is the classic behavior from querying the DNSDB and is the default value for this option.

How many rows to offset (e.g. skip) in the results. This implements an incremental result transfer feature, allowing you to view more of the available results for a single query. The rows are offset prior to the limit parameter being applied, therefore offset allows seeing additional results past a limit that matches the maximum number of results. Note that DNSDB recalculates the results for each query and the order of results might not be preserved. Therefore, this capability is not a valid way to walk all results over multiple queries - some results might be missing and some might be duplicated. The actual offset that can be used is limited or for certain API keys, offset is not allowed - see the offset_max rate_limit key below. The offset value must be a positive integer. The default is 0, which means do not offset the rows.

Query type(name, raw) name: The VALUE is a DNS owner name in presentation format or wildcards as described below. We sometimes call this just an rrset search, raw: The VALUE is an even number of hexadecimal digits specifying a raw octet string.

Query value

Query rrtype

Query bailiwick

Provide results before the defined timestamp for when the DNS record was first observed. For example, the URL parameter 'time_first_before=1420070400' will only provide matching DNS records that were first observed before (or older than) January 1, 2015.

Provide results after the defined timestamp for when the DNS record was first observed. For example, the URL parameter 'time_first_after=-31536000' will only provide results that were first observed within the last year.

Provide results before the defined timestamp for when the DNS record was last observed. For example, the URL parameter 'time_last_before=1356998400' will only provide results for DNS records that were last observed before 2013.

Provide results after the defined timestamp for when the DNS record was last observed. For example, the URL parameter 'time_last_after=-2678400' will only provide results that were last observed after 31 days ago.

Limit for the number of results returned via these lookup methods. There is a built-in limit to the number of results that are returned via these lookup methods. The default limit is set at 10,000. This limit can be raised or lowered by setting the 'limit' query parameter. There is also a maximum number of results allowed; requesting a limit greater than the maximum will only return the maximum. See results_max below for information on that maximum. If '?limit=0' is used then DNSDB will return the maximum number of results allowed. If there are less results for the query than the requested limit, only the actual amount can be returned.

Aggregated results group identical rrsets across all time periods and is the classic behavior from querying the DNSDB. This means you could get the total number of times an rrset has been observed, but not when it was observed. Unaggregated results ungroup identical rrsets, allowing you to see how the domain name was resolved in the DNS across the full-time range covered in DNSDB (subject to time fencing). This can give a more accurate impression of record request volume across time because it will reveal the distinct timestamps of records whose values are repeated. You can answer questions like, 'Was a domain parked for a long time, mostly unused, until it was repurposed for serving malware or relaying spam, but then was abandoned again?' It allows you to see if a record was observed heavily in the last week vs. having been observed constantly for years. This is a boolean value. Use True, the default, for the aggregated results or False for unaggregated results.

A boolean value that is True if time values (in time_first, time_last, zone_time_first, zone_time_last) should be returned in human readable (RFC3339 compliant) format or False if Unix-style time values in seconds since the epoch should be returned. False is the classic behavior from querying the DNSDB and is the default value for this option.

How many rows to offset (e.g. skip) in the results. This implements an incremental result transfer feature, allowing you to view more of the available results for a single query. The rows are offset prior to the limit parameter being applied, therefore offset allows seeing additional results past a limit that matches the maximum number of results. Note that DNSDB recalculates the results for each query and the order of results might not be preserved. Therefore, this capability is not a valid way to walk all results over multiple queries - some results might be missing and some might be duplicated. The actual offset that can be used is limited or for certain API keys, offset is not allowed - see the offset_max rate_limit key below. The offset value must be a positive integer. The default is 0, which means do not offset the rows.