Historical DNS Lookup — Zone Snapshot & Change Baseline

A ordinary DNS lookup answers what resolves today. Historical investigation asks what changed — MX moved to a new host, SPF gained an include, A records pointed at an old CDN. Without a saved baseline, teams reconstruct history from memory or expensive passive DNS contracts.

Our historical DNS lookup captures the full current zone as the first step: run it before migrations, weekly on critical domains, and immediately when incidents start. Filename exports with domain and queriedAt — diff against last week's file to see drift.

The backend aggregates common record types served for the name — IPv4 and IPv6 addresses, mail exchangers with priorities, TXT strings including SPF and DKIM material, nameserver delegations, and canonical aliases. Summary blocks flag SPF, DMARC, and mail presence for quick triage.

queriedAt stamps the capture instant in ISO format for SOC2 and ISO auditors who ask when configuration was verified. Machine-readable timestamps beat screenshots that lack metadata.

Schedule weekly API calls with action dns-history and your domain parameter. Store JSON in Git, S3, or your CMDB. Diff tools highlight added MX hosts, removed AAAA, or TXT drift. That pipeline is genuine historical DNS for your organization at zero passive DNS subscription cost.

Commercial passive DNS indexes global crawler observations — useful for threat intel on third-party domains you do not control. This page optimizes for zones you own and can snapshot on demand.

When DNS hijack is suspected, snapshot before the attacker shortens TTL further. Compare against last known good export from change management. queriedAt proves capture time if legal or insurance reviews the case.

Pair with DNS compare when validating two live domains side by side; use historical DNS lookup when you need a point-in-time archive at rest.

Pre-migration and post-migration snapshots prove parity when cutover completes. Include both files in the ticket permanently. Rollback runbooks restore values from export if the new provider misconfigured NS glue.

Registrar migrations often change NS before records replicate — snapshot immediately after each phase so you know which step introduced drift.

Both pages call dns-history and return identical backend shape. Historical DNS lookup emphasizes change-tracking language for operators searching historical terminology; DNS record history emphasizes snapshot exports for documentation teams. Use whichever page fits your workflow — API action is the same.

Cross-link DNS TTL checker when planning how long a captured state persists in resolver caches worldwide.

Snapshots copy SPF, DKIM, DMARC, and domain verification TXT into exports. Treat snapshot files as reconnaissance-sensitive if they consolidate authentication posture for high-value brands.

Rotate verification tokens if exports leak from shared drives. Public DNS already exposes TXT — snapshots aggregate them for convenience.

Call GET /ip-tools/api/extended?action=dns-history&domain=example.com. Parse records, byType, summary, and queriedAt in JSON. Respect rate limits and secure stored exports.

Integrate with CI after Terraform or DNS provider applies — fail the pipeline if snapshot diff exceeds approved change scope.

Query only domains you own or are contracted to investigate. Lookups hit public DNS — we do not permanently store your searches.

Historical reconstruction from snapshots you save is your data custody responsibility.