Passive DNS has been an industry standard tool for more than a decade, but given the conversations we are having with various customers, IT teams & security teams, it’s apparent that there is some uncertainty as to what Passive DNS is, and also how it can help businesses protect both their networks and brand.
What is Passive DNS?
Until the introduction of Passive DNS there was no way to retrieve the content of any DNS zone owned by other people as system administrators were not keen to share them. Also, once a change was made to a DNS record the previous details were gone forever as the new version immediately propagated across the internet…. Not very helpful if you need to research all the domain names a suspect IP address has resolved to historically, and vice versa.
Where does Passive DNS data come from?
When a client queries a local DNS resolver and the answer is not included in the server’s cache, then the DNS resolver will query an external root server, followed by the top-level domain (TLD) server and the authoritative name server itself to get access to the requested information (see diagram ).
With special probes activated on the DNS resolver, it is possible to record the packets containing the answers to the client, along with the time & date stamp of when the query was made.
Passive DNS does not store which client (or person) made a query, just the fact that at some point in time, a domain has been associated with a specific DNS record . This ensures that privacy is maintained throughout the system.
Passive DNS data from Spamhaus is collected across the internet globally, from trusted third parties including hosting companies, enterprises, business & ISPs.
With the constant increase in the number of TLDs, there are currently more than 1,000, there is a huge amount of data to record. Spamhaus’ Passive DNS cluster handles more than 200 million DNS records per hour and stores hundreds of billions of record per month, allowing you to search this vast database easily.
