# Reverse Nameserver Lookup — Find Domains on a DNS Host (`oswaldocarabano/reverse-nameserver-lookup`) Actor

Reverse nameserver lookup across 1,075 gTLDs: give it a nameserver and get every domain delegated to it. Built from registry zone files rather than a passive DNS sample, so it is the registry's own record of delegation. For infrastructure mapping, OSINT and security research.

- **URL**: https://apify.com/oswaldocarabano/reverse-nameserver-lookup.md
- **Developed by:** [Oswaldo Carabano](https://apify.com/oswaldocarabano) (community)
- **Categories:** Developer tools, AI, Automation
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

Pay per event

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

An Actor is a serverless cloud program that runs on the Apify platform. It has two run modes.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.

Apify vocabulary and the platform model are defined once, in the agent quickstart at https://apify.com/agents.md.

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.

Do not guess an integration path. Every one of them is in the agent quickstart at https://apify.com/agents.md: the Apify MCP server, Agent Skills with the Apify CLI, the JavaScript and Python clients, the REST API, and the account-free path for an agent with no human to sign in. It also carries the rule on stating cost before the first paid run.

For examples already wired to this Actor's own input schema, see the [API](#api) section below.

Each client library has reference documentation the quickstart does not restate: [JavaScript/TypeScript](https://docs.apify.com/api/client/js/docs.md) (`npm install apify-client`) and [Python](https://docs.apify.com/api/client/python/docs.md) (`pip install apify-client`).

# README

## Reverse Nameserver Lookup — Find Domains on a DNS Host

Give it a nameserver, get back the domains delegated to it across 1,075 gTLDs.

This is the query that is genuinely hard to answer any other way. Passive DNS
providers approximate it from observed traffic; this reads the registries' own zone
files, so it is the registry's view of delegation, not a sample of it.

### Coverage

**1,075 gTLDs**, including `.com`, `.net`, `.org`, `.info`, `.biz`, `.xyz`, `.top`,
`.shop`, `.online`, `.site`, `.store`, `.app`, `.dev` and `.cloud` — **255,631,856
delegated domains**, counted from the zone files themselves and refreshed daily.

Coverage is real but it is not evenly spread, and you should know the shape of it
before you rely on it: `.com` alone is 166 million of that total, and while all 1,075
TLDs are included, 481 of them hold fewer than a thousand domains each. Breadth helps
you catch something in an obscure TLD; it is not 1,075 equally busy namespaces.

**Not covered:** `.io`, `.ai`, `.co`, `.me`, `.tv`, `.cc` and every other country-code
TLD. These are not available from ICANN's zone file service at any price — they are run
outside ICANN's contracts. They are also exactly the TLDs a startup expects, so we say
it here rather than letting you find out from an empty result.

**What a zone file does not contain, and no run will ever return:** the registrant,
their email, the registrar, the registration date, the expiry date, or the domain's own
A, MX and TXT records. Any tool promising those needs a different source, and at scale
that source is prohibited by the agreement behind this data.

### Input

Every run is anchored on something you provide. There is no way to ask this Actor for
the whole namespace, and that is a design decision rather than a limitation: the data
agreement behind it forbids handing over a substantial portion of a zone, so the
product simply has no shape that could.

See **Example runs** below for fifteen worked inputs.

### Output

| Field | Meaning |
|---|---|
| `domain` | A domain delegated to that nameserver |
| `tld` | Its top-level domain |
| `nameserver` | The nameserver that matched |
| `all_nameservers` | Every nameserver this domain delegates to |
| `dnssec` | Whether the domain publishes a DS record. **5.0%** of domains do |
| `dns_provider` | Who runs the DNS, inferred from the nameserver. **69.1%** filled. A hosting fact, not a technology one |
| `parked_for_sale` | True when the nameserver belongs to a parking or domain-sale service. **2.0%** of domains, exact when it fires |

### Reading the results

**Pivoting is only meaningful on custom nameservers.** If you look up
`ns1.cloudflare.com` the honest answer is tens of millions of unrelated domains, and
the row cap will stop you long before you have anything useful. Cloudflare alone is
20.9% of the namespace. Where this Actor earns its keep is on a nameserver that
belongs to one organisation: a company's own `ns1.company.com`, a small hosting
provider, a specific infrastructure you are investigating.

**Shared hosting is not a relationship.** Two domains on the same big provider's
nameservers have nothing to do with each other. Two domains on the same obscure,
self-run nameserver very often do. Read `dns_provider` to tell those cases apart
before drawing conclusions.

**`dnssec` varies enormously by TLD.** The global rate is 5.0%, but it ranges from 0%
to 100% depending on the registry — 14.1% in `.dev`, 5.5% in `.net`, 0.9% in `.bond`.
Do not read a low rate as a finding about the domain.

**`dns_provider` says who runs the DNS, not what the site is built with.** The
nameserver identifies the DNS operator for 69% of domains, but a domain on Cloudflare
can be running anything. Website platforms are configured with A and CNAME records,
which a zone file does not contain, so we cannot see them and we do not guess.

**An empty result is a real answer**: that nameserver currently hosts nothing else in
the zones we cover. It only costs the $0.00001 start fee.

### Example runs

**1. Inventory every domain on your provider nameservers**

```json
{
  "nameserver": [
    "ns1.digitalocean.com",
    "ns2.digitalocean.com"
  ],
  "maxResults": 500
}
```

**2. Nameserver lookup for a small hosting provider**

```json
{
  "nameserver": [
    "ns1.digitalocean.com"
  ],
  "maxResults": 1000
}
```

**3. List every domain on both nameservers of one registrar**

```json
{
  "nameserver": [
    "dns1.registrar-servers.com",
    "dns2.registrar-servers.com"
  ],
  "maxResults": 1000
}
```

**4. Investigate a nameserver that hosts suspended domains**

```json
{
  "nameserver": [
    "suspended1.plaindns.net",
    "suspended2.plaindns.net"
  ],
  "maxResults": 5000
}
```

**5. Map a bulk DNS operator and everything it serves**

```json
{
  "nameserver": [
    "ns1.dyna-ns.net",
    "ns2.dyna-ns.net"
  ],
  "maxResults": 5000
}
```

**6. Find domains using a regional registrar DNS**

```json
{
  "nameserver": [
    "ns1.dondominio.com"
  ],
  "maxResults": 2000
}
```

**7. Audit a corporate domain portfolio held at one registrar**

```json
{
  "nameserver": [
    "ns07.domaincontrol.com",
    "ns08.domaincontrol.com"
  ],
  "maxResults": 5000
}
```

**8. Due diligence: find every domain an enterprise brand keeps**

```json
{
  "nameserver": [
    "ns1.markmonitor.com",
    "ns2.markmonitor.com"
  ],
  "maxResults": 1000
}
```

**9. Find domains on an independent DNS operator**

```json
{
  "nameserver": [
    "ns1.he.net"
  ],
  "maxResults": 200
}
```

**10. Pivot from a bulk-registration nameserver to its full list**

```json
{
  "nameserver": [
    "dns29.hichina.com"
  ],
  "maxResults": 2000
}
```

**11. Reverse lookup on an enterprise DNS vendor**

```json
{
  "nameserver": [
    "udns1.ultradns.net"
  ],
  "maxResults": 500
}
```

**12. Compare the domain footprint of two cloud DNS providers**

```json
{
  "nameserver": [
    "ns1.digitalocean.com",
    "ns1.linode.com"
  ],
  "maxResults": 2000
}
```

**13. List every domain served by one shared web host**

```json
{
  "nameserver": [
    "ns1.hostgator.com"
  ],
  "maxResults": 500
}
```

**14. List domains parked on a domain sale service**

```json
{
  "nameserver": [
    "ns1.afternic.com"
  ],
  "maxResults": 1000
}
```

**15. Weekly nameserver inventory of your own domains**

```json
{
  "nameserver": [
    "ns1.mycompany.com",
    "ns2.mycompany.com"
  ],
  "maxResults": 5000
}
```

### Pricing

**$0.00001 to start, then $0.003 per domain found** — about **$3 per 1,000 results**.

There is no comparable Actor in the Store, because the query needs zone file access
that is granted one TLD at a time. The services that do answer it — passive DNS and
domain intelligence platforms — start in the hundreds of dollars per month and give you
their observed sample rather than the registry's record.

Start with the default cap of 100 rows. On a popular nameserver the honest answer is
millions of domains, and the cap exists so you find that out for $0.30.

### Data source

> 🛡️ **Sourced from the Registry Operators' own zone files**, obtained through ICANN's
> Centralized Zone Data Service under agreement with those operators. ICANN does not
> endorse, sponsor or review this Actor.

Built for security research, brand protection and domain analytics. The access behind
this data was granted one TLD at a time, which is why the coverage is what it is.

### Support

Found a domain the Actor missed, or a row that looks wrong? Open an issue on the Actor
page with the exact input you used. Zone data is refreshed once a day, so a domain
delegated this morning may not appear until tomorrow's snapshot.

# Actor input Schema

## `nameserver` (type: `array`):

The nameserver hostnames to look up, for example ns1.example-dns.com. Pivoting is only meaningful on custom nameservers — see the README.

## `maxResults` (type: `integer`):

Hard cap on rows returned. Kept low on purpose so a first run cannot burn your free credit. Raise it deliberately. The service will never return more than 50,000 rows in one run.

## Actor input object example

```json
{
  "nameserver": [
    "ns1.digitalocean.com"
  ],
  "maxResults": 100
}
```

# Actor output Schema

## `dataset` (type: `string`):

Reverse nameserver lookup across 1,075 gTLDs: give it a nameserver and get every domain delegated to it. Built from registry zone files rather than a passive DNS sample, so it is the registry's own record of delegation. For infrastructure mapping, OSINT and security research.

## `runSummary` (type: `string`):

How many rows matched, whether the row cap truncated the answer, and the date of the zone data used. If truncated is true, you are seeing a partial answer.

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "nameserver": [
        "ns1.digitalocean.com"
    ]
};

// Run the Actor and wait for it to finish
const run = await client.actor("oswaldocarabano/reverse-nameserver-lookup").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = { "nameserver": ["ns1.digitalocean.com"] }

# Run the Actor and wait for it to finish
run = client.actor("oswaldocarabano/reverse-nameserver-lookup").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "nameserver": [
    "ns1.digitalocean.com"
  ]
}' |
apify call oswaldocarabano/reverse-nameserver-lookup --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,oswaldocarabano/reverse-nameserver-lookup"
        }
    }
}
```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/27i11D1kCRtEo3NbF/builds/AgSIONsuamDhezZ47/openapi.json