Passive DNS.

Passive DNS (pDNS) is built by sensors placed just above recursive resolvers that record the responses the resolver receives, without ever querying authoritative servers themselves. The technique was introduced by Florian Weimer in his 2005 paper Passive DNS Replication, presented at the FIRST conference; his system logged resolver answers and replicated them into a central, queryable database. Sensors typically capture only inter-server (cache-miss) traffic above the resolver, so they avoid recording the stub queries of individual end users.

Datasets from providers such as Farsight DNSDB (now part of DomainTools), VirusTotal, SecurityTrails, and CIRCL let defenders pivot from a domain to historical IPs, sibling domains, name servers, and first-seen/last-seen timestamps. Many expose records in the IETF Common Output Format (COF, draft-dulaunoy-dnsop-passive-dns-cof) so results are interchangeable across vendors. It is a core resource for threat hunting, malware infrastructure mapping, takedowns, and tracking fast-flux and domain-generation algorithms — for example, confirming that a phishing domain first resolved only hours before a campaign began. Because pDNS records only what was actually observed, it complements WHOIS, certificate transparency, and active scanning, and it is non-intrusive to the operators of the observed domains.

flowchart LR
  C[Clients] --> R[Recursive resolver]
  R -->|cache-miss queries| AUTH[Authoritative servers]
  S[pDNS sensor] -. observes responses .-> R
  S --> DB[(Passive DNS database)]
  AN[Analyst] -->|pivot on domain / IP| DB
  DB -->|historical resolutions| AN