DNS History API - Subdomains, WHOIS History, SSL, IP Search

Pull DNS history, subdomains, current and historical WHOIS, SSL certificates, associated domains, reverse domain search and IP search from the SecurityTrails API with your own API key, as one clean dataset row per record.

SecurityTrails (part of Recorded Future) keeps one of the largest passive DNS and WHOIS archives on the internet. This actor wraps its official REST API v1 on api.securitytrails.com: give domains, IPs, a search filter or a DSL query, and get deduplicated rows you can download as JSON, CSV or Excel, schedule, or feed into attack surface monitoring, threat hunting, brand protection, M&A due diligence, SIEM enrichment, Google Sheets and AI agents. Bring your own API key.

BYOK, not live-tested: every path, parameter and enum comes from the SecurityTrails API reference on docs.securitytrails.com, but the actor has not been run against a live SecurityTrails key, and the API gateway rejects unknown keys before routing, so the routes could not be confirmed with a test call.

What it does

• Current DNS: one row per domain with its A, AAAA, MX, NS, SOA and TXT records, the date each set was first seen, and how many other domains share each IP, mail server and name server.
• Subdomain finder: every subdomain SecurityTrails knows for a domain, one row each, as full hostnames.
• DNS history: historical A, AAAA, MX, NS, SOA and TXT records with first seen and last seen dates and the hosting organizations, paged.
• Current WHOIS and WHOIS history: registrar, creation, update and expiry dates, name servers and contacts, now and across every recorded change.
• SSL certificates: valid, expired or all certificates for a domain (optionally its subdomains), with SAN names, issuer, validity and fingerprints.
• Associated domains: domains that share an owner with the one you give, with registrar, hosting and mail providers and company name.
• Domain search: query the whole database by IP or CIDR, name server, MX, CNAME, SOA email, keyword, TLD or WHOIS email, name, organization, phone or address (reverse WHOIS, reverse IP, reverse NS and reverse MX).
• IP search and IP WHOIS: find IPs by PTR pattern or open port with the SecurityTrails DSL, and read the owner of any IPv4 address.
• Pay only for results: refused and empty lookups are recorded as a free row that says why, never charged.

How to get an API key

Sign up at securitytrails.com; a free account includes a small monthly allowance of API queries, and paid plans raise it and open more endpoints. Copy the key from the API Keys page of your account, paste it into the API key field, or set the DATA_API_KEY secret. The key is sent only to api.securitytrails.com in the APIKEY header, as the documentation recommends, and is removed from everything the actor logs.

Input

Field	Modes	Description
mode	all	domainDetails (default), subdomains, dnsHistory, whois, whoisHistory, sslCertificates, associatedDomains, domainSearch, ipSearch or ipWhois
domains	domain modes	One hostname per line, such as example.com
ips	IP WHOIS	One IPv4 address per line
dnsRecordTypes	DNS history	Any of a (default), aaaa, mx, ns, soa, txt
sslStatus	SSL certificates	valid (default), all or expired
sslIncludeSubdomains	SSL certificates	Also list subdomain certificates (default false)
domainSearchFilter	domain search	JSON object of documented filter fields, such as {"whois_email": "dns-admin@example.com"}
includeIps	domain search	Resolve and return each hit's IPs (default false)
ipSearchQuery	IP search	DSL query, such as ptr_part = 'amazon.com'
maxPages	paged modes	Pages to read per lookup, default 10, at most 100
maxResults	all	Row ceiling for the run (default 100)
requestsPerMinute	all	Pacing, default 60
apiKey	all	Your SecurityTrails API key (or the DATA_API_KEY secret)

Example: the A and MX record history of two domains.

{
    "mode": "dnsHistory",
    "domains": ["example.com", "example.org"],
    "dnsRecordTypes": ["a", "mx"],
    "maxPages": 5
}

Example: every domain on a name server (reverse NS).

{
    "mode": "domainSearch",
    "domainSearchFilter": { "ns": "ns1.example.net" },
    "includeIps": true
}

Example output

An illustrative DNS history row, shaped like the documented response (values are an example, not real data). Every field the API returns is kept.

{
    "mode": "dnsHistory",
    "modeLabel": "DNS history",
    "recordType": "dnsHistory",
    "target": "example.com A",
    "hostname": "example.com",
    "ip": null,
    "dnsType": "a",
    "values": ["93.184.215.14"],
    "firstSeen": "2024-01-15",
    "lastSeen": "2026-10-17",
    "registrar": null,
    "createdDate": null,
    "expiresDate": null,
    "organizations": ["Edgecast Inc."],
    "hostProviders": null,
    "mailProviders": null,
    "companyName": null,
    "alexaRank": null,
    "found": true,
    "historyType": "a/ipv4",
    "retrievedAt": "2026-10-18T12:00:00.000Z",
    "note": null
}

FAQ

What is the SecurityTrails API?

SecurityTrails is a DNS, domain and IP intelligence service owned by Recorded Future. Its REST API on api.securitytrails.com returns current and historical DNS records, subdomains, WHOIS history, SSL certificates, associated domains and search across its passive DNS and WHOIS database, authenticated with an API key.

Do I need my own SecurityTrails API key?

Yes. This is a bring-your-own-key actor: it calls SecurityTrails with your key, under your plan and terms. A missing or rejected key, or a plan that is out of queries, ends the run cleanly with a status message that explains what to change, and nothing is charged.

How do I find all subdomains of a domain?

Choose the Subdomains mode and add the domain. SecurityTrails returns every subdomain label it has observed, and the actor writes each one as a full hostname such as api.example.com. For certificates issued to subdomains, use SSL certificates with Include subdomain certificates on.

How far back does the DNS history go?

As far as the SecurityTrails archive goes for that domain and record type; the API pages through everything it holds. Each history row carries first seen and last seen dates for one set of values, so you can see when a domain moved hosting, changed mail provider or swapped name servers.

Can I do a reverse WHOIS, reverse IP or reverse NS lookup?

Yes, with Domain search. A filter of whois_email, whois_name or whois_organization is a reverse WHOIS, ipv4 (with an optional CIDR mask) is a reverse IP, ns is a reverse name server and mx a reverse mail server lookup. Fields are combined with AND.

Why does an endpoint answer that it is not on my plan?

SecurityTrails answers 403 when the key is valid but the endpoint is outside your plan. Free plans cover fewer endpoints and a small monthly allowance; history, search and associated domains need a paid plan on many accounts. Pick another mode or upgrade the plan.

How many API queries does a run use?

One per domain, IP or search, and one per page in the paged modes (DNS history per record type, WHOIS history, associated domains, domain search and IP search). Maximum pages per lookup caps the pages, and the run log reports the exact request count.

What do I pay?

Pay per result: 0.01 USD per current DNS, current WHOIS or IP WHOIS row and 0.005 USD per subdomain, history record, certificate or search hit. Refused and empty lookups are never charged. Your SecurityTrails plan is billed separately by SecurityTrails.

Pricing

Event	Price	Charged for
domain-or-ip-lookup	0.01 USD	Each current DNS, current WHOIS or IP WHOIS row
list-record	0.005 USD	Each subdomain, DNS or WHOIS history record, certificate, associated domain or search hit

Keyword map

SecurityTrails API, DNS history API, historical DNS records, passive DNS, subdomain finder, subdomain enumeration, WHOIS history API, WHOIS lookup, reverse WHOIS, reverse IP lookup, reverse NS lookup, reverse MX lookup, associated domains, SSL certificate lookup, certificate transparency, IP WHOIS, attack surface discovery, domain intelligence, threat intelligence, Recorded Future.

Terms and data use

Use of the SecurityTrails API is governed by the Recorded Future Terms of Use (version 7.0, which section 9.13 applies to all SecurityTrails services) and by your plan's order form or API agreement. Section 1(A) limits use of the service and its output to your own internal security purposes, and free versions to internal, non-commercial security purposes. Section 3 forbids reselling, distributing or disclosing the data to third parties, and states that redistribution, transfer, resale, licence or copies of any data obtained through the service are not allowed unless your agreement with Recorded Future permits it. The terms set no cache or retention time limit on data you retrieve. Run this actor with your own key, keep the results for your own internal security work, and do not publish or resell them without written permission from Recorded Future. This actor is not affiliated with or endorsed by SecurityTrails or Recorded Future.