Reverse Nameserver Lookup — Find Domains on a DNS Host

Give it a nameserver, get back the domains delegated to it across 1,075 gTLDs.

This is the query that is genuinely hard to answer any other way. Passive DNS providers approximate it from observed traffic; this reads the registries' own zone files, so it is the registry's view of delegation, not a sample of it.

Coverage

1,075 gTLDs, including .com, .net, .org, .info, .biz, .xyz, .top, .shop, .online, .site, .store, .app, .dev and .cloud — 255,631,856 delegated domains, counted from the zone files themselves and refreshed daily.

Coverage is real but it is not evenly spread, and you should know the shape of it before you rely on it: .com alone is 166 million of that total, and while all 1,075 TLDs are included, 481 of them hold fewer than a thousand domains each. Breadth helps you catch something in an obscure TLD; it is not 1,075 equally busy namespaces.

Not covered: .io, .ai, .co, .me, .tv, .cc and every other country-code TLD. These are not available from ICANN's zone file service at any price — they are run outside ICANN's contracts. They are also exactly the TLDs a startup expects, so we say it here rather than letting you find out from an empty result.

What a zone file does not contain, and no run will ever return: the registrant, their email, the registrar, the registration date, the expiry date, or the domain's own A, MX and TXT records. Any tool promising those needs a different source, and at scale that source is prohibited by the agreement behind this data.

Input

Every run is anchored on something you provide. There is no way to ask this Actor for the whole namespace, and that is a design decision rather than a limitation: the data agreement behind it forbids handing over a substantial portion of a zone, so the product simply has no shape that could.

See Example runs below for fifteen worked inputs.

Output

Field	Meaning
domain	A domain delegated to that nameserver
tld	Its top-level domain
nameserver	The nameserver that matched
all_nameservers	Every nameserver this domain delegates to
dnssec	Whether the domain publishes a DS record. 5.0% of domains do
dns_provider	Who runs the DNS, inferred from the nameserver. 69.1% filled. A hosting fact, not a technology one
parked_for_sale	True when the nameserver belongs to a parking or domain-sale service. 2.0% of domains, exact when it fires

Reading the results

Pivoting is only meaningful on custom nameservers. If you look up ns1.cloudflare.com the honest answer is tens of millions of unrelated domains, and the row cap will stop you long before you have anything useful. Cloudflare alone is 20.9% of the namespace. Where this Actor earns its keep is on a nameserver that belongs to one organisation: a company's own ns1.company.com, a small hosting provider, a specific infrastructure you are investigating.

Shared hosting is not a relationship. Two domains on the same big provider's nameservers have nothing to do with each other. Two domains on the same obscure, self-run nameserver very often do. Read dns_provider to tell those cases apart before drawing conclusions.

dnssec varies enormously by TLD. The global rate is 5.0%, but it ranges from 0% to 100% depending on the registry — 14.1% in .dev, 5.5% in .net, 0.9% in .bond. Do not read a low rate as a finding about the domain.

dns_provider says who runs the DNS, not what the site is built with. The nameserver identifies the DNS operator for 69% of domains, but a domain on Cloudflare can be running anything. Website platforms are configured with A and CNAME records, which a zone file does not contain, so we cannot see them and we do not guess.

An empty result is a real answer: that nameserver currently hosts nothing else in the zones we cover. It only costs the $0.00001 start fee.

Example runs

1. Inventory every domain on your provider nameservers

{
  "nameserver": [
    "ns1.digitalocean.com",
    "ns2.digitalocean.com"
  ],
  "maxResults": 500
}

2. Nameserver lookup for a small hosting provider

{
  "nameserver": [
    "ns1.digitalocean.com"
  ],
  "maxResults": 1000
}

3. List every domain on both nameservers of one registrar

{
  "nameserver": [
    "dns1.registrar-servers.com",
    "dns2.registrar-servers.com"
  ],
  "maxResults": 1000
}

4. Investigate a nameserver that hosts suspended domains

{
  "nameserver": [
    "suspended1.plaindns.net",
    "suspended2.plaindns.net"
  ],
  "maxResults": 5000
}

5. Map a bulk DNS operator and everything it serves

{
  "nameserver": [
    "ns1.dyna-ns.net",
    "ns2.dyna-ns.net"
  ],
  "maxResults": 5000
}

6. Find domains using a regional registrar DNS

{
  "nameserver": [
    "ns1.dondominio.com"
  ],
  "maxResults": 2000
}

7. Audit a corporate domain portfolio held at one registrar

{
  "nameserver": [
    "ns07.domaincontrol.com",
    "ns08.domaincontrol.com"
  ],
  "maxResults": 5000
}

8. Due diligence: find every domain an enterprise brand keeps

{
  "nameserver": [
    "ns1.markmonitor.com",
    "ns2.markmonitor.com"
  ],
  "maxResults": 1000
}

9. Find domains on an independent DNS operator

{
  "nameserver": [
    "ns1.he.net"
  ],
  "maxResults": 200
}

10. Pivot from a bulk-registration nameserver to its full list

{
  "nameserver": [
    "dns29.hichina.com"
  ],
  "maxResults": 2000
}

11. Reverse lookup on an enterprise DNS vendor

{
  "nameserver": [
    "udns1.ultradns.net"
  ],
  "maxResults": 500
}

12. Compare the domain footprint of two cloud DNS providers

{
  "nameserver": [
    "ns1.digitalocean.com",
    "ns1.linode.com"
  ],
  "maxResults": 2000
}

13. List every domain served by one shared web host

{
  "nameserver": [
    "ns1.hostgator.com"
  ],
  "maxResults": 500
}

14. List domains parked on a domain sale service

{
  "nameserver": [
    "ns1.afternic.com"
  ],
  "maxResults": 1000
}

15. Weekly nameserver inventory of your own domains

{
  "nameserver": [
    "ns1.mycompany.com",
    "ns2.mycompany.com"
  ],
  "maxResults": 5000
}

Pricing

$0.00001 to start, then $0.003 per domain found — about $3 per 1,000 results.

There is no comparable Actor in the Store, because the query needs zone file access that is granted one TLD at a time. The services that do answer it — passive DNS and domain intelligence platforms — start in the hundreds of dollars per month and give you their observed sample rather than the registry's record.

Start with the default cap of 100 rows. On a popular nameserver the honest answer is millions of domains, and the cap exists so you find that out for $0.30.

Data source

🛡️ Sourced from the Registry Operators' own zone files, obtained through ICANN's Centralized Zone Data Service under agreement with those operators. ICANN does not endorse, sponsor or review this Actor.

Built for security research, brand protection and domain analytics. The access behind this data was granted one TLD at a time, which is why the coverage is what it is.

Support

Found a domain the Actor missed, or a row that looks wrong? Open an issue on the Actor page with the exact input you used. Zone data is refreshed once a day, so a domain delegated this morning may not appear until tomorrow's snapshot.