DNSDB

Member Freelancer Small Business Corporate Enterprise

The DNSDB API provides a fast way to see the information associated with a domain name. It gives an at-a-glance view of how a domain is configured: its subdomains, nameservers, hosting and CDN providers and email security records (DMARC, SPF, DKIM), combined with the open ports, technologies and vulnerabilities that InternetDB knows about for the domain's IPs. The data is refreshed once a week.

Authentication

Every lookup requires a Shodan API key. Send it in the Authorization header:

curl -H "Authorization: token YOUR_API_KEY" https://dnsdb.shodan.io/example.com

You can also pass the key as the key query parameter (?key=YOUR_API_KEY), but we recommend the header because URLs tend to end up in server logs. API clients without valid credentials receive a 401 response.

Lookup

GET /{domain} returns the stored record for a domain as JSON.

import requests

headers = {"Authorization": "token YOUR_API_KEY"}
dns_info = requests.get("https://dnsdb.shodan.io/google.com", headers=headers).json()

Below is a sample response:

{
    "domain": "example.com",
    "subdomain_count": 2,
    "subdomains": ["www", "api"],
    "port_distribution": {"80": 3, "443": 3},
    "tag_distribution": {"cdn": 2},
    "technologies": ["cpe:/a:f5:nginx"],
    "subdomain_ports": {"www": {"80": 2, "443": 2}, "api": {"443": 1}},
    "has_dmarc": true,
    "has_spf": true,
    "has_dkim": false,
    "supports_ipv6": true,
    "hosting_providers": ["aws", "dns-route53"],
    "cdn_providers": ["cloudflare"],
    "nameservers": ["ns-1.awsdns-01.org"],
    "txt_records": ["v=spf1 include:_spf.example.com ~all"],
    "ips": ["93.184.216.34", "2606:2800:220:1:248:1893:25c8:1946"],
    "vulns_count": 2,
    "vulns": ["CVE-2021-41773", "CVE-2023-44487"]
}

The domain parameter is normalized before the lookup: it is lowercased, Unicode names are converted to punycode, and subdomains or full hostnames resolve to the registrable domain. For example, a lookup for www.example.com returns the record for example.com.

Response Fields

Field	Type	Description
`domain`	string	The registrable domain that was looked up
`subdomain_count`	integer	Number of entries in `subdomains`
`subdomains`	array of strings	Subdomain prefixes, such as `www` (not full hostnames)
`port_distribution`	object	Port number mapped to the number of the domain's IPs with that port open
`tag_distribution`	object	InternetDB tag (such as `cdn` or `vpn`) mapped to the number of the domain's IPs with that tag
`technologies`	array of strings	CPE identifiers detected on the domain's IPs, such as `cpe:/a:f5:nginx`
`subdomain_ports`	object	Subdomain prefix mapped to an object of port number and the number of IPs serving that subdomain with the port open
`has_dmarc`	boolean	Whether a DMARC record was seen
`has_spf`	boolean	Whether an SPF record was seen
`has_dkim`	boolean	Whether a DKIM record was seen
`supports_ipv6`	boolean	Whether the domain or any of its subdomains has an AAAA record
`hosting_providers`	array of strings	Hosting providers as lowercase ids, such as `aws`. DNS providers found from NS records are prefixed with `dns-`, such as `dns-route53`
`cdn_providers`	array of strings	CDN providers as lowercase ids, such as `cloudflare`
`nameservers`	array of strings	Nameservers from NS records
`txt_records`	array of strings	TXT records
`ips`	array of strings	IPv4 and IPv6 addresses the domain and its subdomains resolve to
`vulns_count`	integer	Total CVE findings across the domain's IPs. A CVE found on several IPs is counted once per IP, so this can be higher than the length of `vulns`
`vulns`	array of strings	Unique CVE identifiers found on the domain's IPs

To keep responses a manageable size, some fields are capped: subdomains at 100,000 entries, ips at 50,000, subdomain_ports at 50,000 subdomains with up to 20 ports each, vulns at 5,000, technologies at 500, nameservers and txt_records at 20, and hosting_providers and cdn_providers at 10.