Reverse DNS Lookup API - Find Every Hostname Behind an IP, MX, NS, or CNAME
You have one suspicious IP and no idea what else lives on it. Standard reverse lookups hand back a single PTR record and stop there. The Reverse DNS Lookup API pivots from any IP, CIDR block, mail server, nameserver, or CNAME target to the full set of hostnames tied to it, across A, AAAA, MX, NS, SOA, SPF, TXT, and CNAME records. Results come back paginated with per-record detail, and wildcard patterns let you match whole provider families in one call. It's built for security engineers mapping attack surface, threat researchers pivoting on infrastructure, and DevOps teams auditing DNS. Start with 10,000 free credits, no credit card required.
Features
Reverse Lookups Across Eight Record Types
One type parameter switches the lookup across A, AAAA, MX, NS, SOA, SPF, TXT, and CNAME. Point it at an IP or CIDR for A/AAAA, a mail host for MX, a nameserver for NS, or a target hostname for CNAME. Each match in reverseDnsRecords carries the domainName, the resolved dnsRecords array, and the raw record text — so you can pivot from any DNS signal to the domains behind it.
Use it as a reverse NS lookup API to map every domain on a nameserver, or a reverse MX API to surface every tenant of a mail provider.
Wildcard Regex Matching
The value parameter accepts wildcard patterns like m*.google.com, n*.g*.com, or *.netlify.app, not just exact strings. Match an entire nameserver family, every mail host under a provider, or all domains on a CNAME target in a single request.
Pair it with the exact flag to flip between broad discovery (all matching records) and precise verification (exact matches only) without changing your query structure.
IP and CIDR Range Input
Query a single address or a whole block — 8.8.8.8 or 135.181.0.0/16 — and get back every hostname resolving into that space. This is the reverse IP lookup API path: feed it an IP range and enumerate the domains sharing that infrastructure, with each result timestamped by queryTime so you can tell current tenants from stale ones.
Paginated Results with Full Counts
Every response reports totalRecords, totalPages, and currentPage, with up to 100 records per page. High-density IPs and popular nameservers can return tens of thousands of hostnames; pagination keeps each response fast and lets you stream large result sets in order rather than truncating them silently.
Historical Coverage per Record
Each entry in dnsRecords includes a queryTime, so results aren't limited to what resolves right now — you see when a hostname was last observed on that IP, mail server, or nameserver.
Combine this with the Historical DNS Lookup API to reconstruct how a piece of infrastructure changed hands over time.
Built for These Use Cases
Attack-surface mapping from a single IP
Feed one address or CIDR block into a reverse A lookup and enumerate every hostname resolving into that space. Security teams use this to find forgotten assets, shadow subdomains, and co-hosted services before an attacker does — the full footprint behind an IP, not just its PTR record.
Threat-infrastructure pivoting
Start from one attacker-controlled IP and pull every domain it hosts — phishing pages, C2 endpoints, and malware sites frequently share a server under different names. Then pivot on the mail servers and nameservers those domains use to widen the investigation. Reverse lookups across record types turn a single indicator into a full infrastructure picture.
Finding every tenant of a provider
Point a reverse CNAME or MX lookup at a SaaS platform's target hostname or a mail provider's exchange, using a wildcard to match the whole family. You get back every domain pointing at that infrastructure — useful for competitive research, provider-migration audits, and mapping who depends on a given service.
Email deliverability and PTR verification
Check which hostnames resolve to your sending IPs and confirm your mail servers are configured the way you expect. Reverse MX and reverse A lookups let deliverability engineers verify PTR alignment across a fleet before it costs them inbox placement.
API Endpoint
$ pip install requestsimport requests
url = "https://api.apifreaks.com/v1.0/domain/dns/reverse?type=A&value=8.8.8.8%2F32&exact=false&page=1"
payload = {}
headers = {
'X-apiKey': 'API-KEY'
}
response = requests.request("GET", url, headers=headers, data=payload)
print(response.text)
How to Guides
Reverse IP Lookup (Basic Call)
Start with the most common pivot: one IP to every hostname behind it. Pass the address as value and A as type. The response returns each domain in reverseDnsRecords with its resolved records and a queryTime telling you when it was last seen on that IP.
# Response { "totalRecords": 93443, "totalPages": 935, "currentPage": 1, "reverseDnsRecords": [ { "queryTime": "2024-05-30", "domainName": "www.maguire.romamenu.cotest.avalon-invest.pro", "dnsTypes": { "A": 1 }, "dnsRecords": [ { "name": "www.maguire.romamenu.cotest.avalon-invest.pro", "type": 1, "dnsType": "A", "ttl": 300, "rawText": "www.maguire.romamenu.cotest.avalon-invest.pro.\t300\tIN\tA\t8.8.8.8", "rRsetType": 1, "address": "8.8.8.8" } ] }, { "queryTime": "2026-07-16", "domainName": "ghrxjxhg00.cn.trustexporter.com", "dnsTypes": { "A": 1 }, "dnsRecords": [ { "name": "ghrxjxhg00.cn.trustexporter.com", "type": 1, "dnsType": "A", "ttl": 777, "rawText": "ghrxjxhg00.cn.trustexporter.com.\t777\tIN\tA\t8.8.8.8", "rRsetType": 1, "address": "8.8.8.8" } ] }, { "queryTime": "2026-06-13", "domainName": "qa-allure.salt-dev.ws", "dnsTypes": { "A": 1 }, "dnsRecords": [ { "name": "qa-allure.salt-dev.ws", "type": 1, "dnsType": "A", "ttl": 300, "rawText": "qa-allure.salt-dev.ws.\t300\tIN\tA\t8.8.8.8", "rRsetType": 1, "address": "8.8.8.8" } ] } . . . . ] }curl -X GET 'https://api.apifreaks.com/v1.0/domain/dns/reverse?value=8.8.8.8&type=A&apiKey=API-KEY'
Enumerate a CIDR Range
When you're auditing owned infrastructure or mapping a hosting provider, query the whole block instead of one address. Pass a CIDR as value with type=A; paginate through totalPages to pull the complete set of resolving hostnames.
# Response { "totalRecords": 102274, "totalPages": 1023, "currentPage": 1, "reverseDnsRecords": [ { "queryTime": "2025-07-12", "domainName": "brianwrightmusic.com", "dnsTypes": { "A": 1 }, "dnsRecords": [ { "name": "brianwrightmusic.com", "type": 1, "dnsType": "A", "ttl": 14400, "rawText": "brianwrightmusic.com.\t14400\tIN\tA\t8.8.8.99", "rRsetType": 1, "address": "8.8.8.99" } ] }, { "queryTime": "2026-06-18", "domainName": "farmersroyaltyco.com", "dnsTypes": { "A": 1 }, "dnsRecords": [ { "name": "farmersroyaltyco.com", "type": 1, "dnsType": "A", "ttl": 3600, "rawText": "farmersroyaltyco.com.\t3600\tIN\tA\t8.8.8.224", "rRsetType": 1, "address": "8.8.8.224" } ] } . . . . ] }curl -X GET 'https://api.apifreaks.com/v1.0/domain/dns/reverse?value=135.181.0.0/16&type=A&apiKey=API-KEY'
Reverse NS Lookup with a Wildcard
To map every domain delegated to a nameserver family, hand the value parameter a wildcard pattern and set type=NS. This catches an entire provider's nameserver range in one call instead of querying each host separately.
# Response { "totalRecords": 237683034, "totalPages": 2376831, "currentPage": 1, "reverseDnsRecords": [ { "queryTime": "2023-08-30", "domainName": "mimibeour.com", "dnsTypes": { "NS": 2 }, "dnsRecords": [ { "name": "mimibeour.com", "type": 2, "dnsType": "NS", "ttl": 21600, "rawText": "mimibeour.com.\t21600\tIN\tNS\tmaya.ns.cloudflare.com.", "rRsetType": 2, "singleName": "maya.ns.cloudflare.com." } ] }, { "queryTime": "2023-02-24", "domainName": "go-codings-ok.live", "dnsTypes": { "NS": 2 }, "dnsRecords": [ { "name": "go-codings-ok.live", "type": 2, "dnsType": "NS", "ttl": 21600, "rawText": "go-codings-ok.live.\t21600\tIN\tNS\tkate.ns.cloudflare.com.", "rRsetType": 2, "singleName": "kate.ns.cloudflare.com." } ] } . . . . ] }curl -X GET 'https://api.apifreaks.com/v1.0/domain/dns/reverse?value=n*.cloudns.net&type=NS&apiKey=API-KEY'
Reverse MX Lookup for a Mail Provider
To find every domain routing mail through a given provider, target its exchange host with type=MX. Wildcards let you match the provider's whole MX family — useful for mapping a competitor's mail footprint or auditing your own.
# Response { "totalRecords": 8125275, "totalPages": 81253, "currentPage": 1, "reverseDnsRecords": [ { "queryTime": "2026-06-12", "domainName": "cucooficial.com", "dnsTypes": { "MX": 15 }, "dnsRecords": [ { "name": "cucooficial.com", "type": 15, "dnsType": "MX", "ttl": 300, "rawText": "cucooficial.com.\t300\tIN\tMX\t20 mx2.zoho.com.", "rRsetType": 15, "target": "mx2.zoho.com.", "priority": 20 } ] }, { "queryTime": "2024-08-25", "domainName": "mpessencial.com.br", "dnsTypes": { "MX": 15 }, "dnsRecords": [ { "name": "mpessencial.com.br", "type": 15, "dnsType": "MX", "ttl": 14400, "rawText": "mpessencial.com.br.\t14400\tIN\tMX\t10 mx2.zoho.com.", "rRsetType": 15, "target": "mx2.zoho.com.", "priority": 10 } ] } . . . . ] }curl -X GET 'https://api.apifreaks.com/v1.0/domain/dns/reverse?value=mx*.zoho.com&type=MX&apiKey=API-KEY'
Exact-Match Verification
Discovery mode returns everything that matches; verification needs precision. Set exact=trueto return only exact matches for NS, MX, CNAME, SOA, SPF, and TXT — the right mode when you're confirming a specific record rather than casting a wide net.
# Response { "totalRecords": 1427, "totalPages": 15, "currentPage": 1, "reverseDnsRecords": [ { "queryTime": "2023-02-16", "domainName": "zakk.guru", "dnsTypes": { "CNAME": 5 }, "dnsRecords": [ { "name": "zakk.guru", "type": 5, "dnsType": "CNAME", "ttl": 300, "rawText": "zakk.guru.\t300\tIN\tCNAME\twww.google.com.", "rRsetType": 5, "target": "www.google.com." } ] }, { "queryTime": "2023-11-18", "domainName": "usndpgrantelig.usga.org", "dnsTypes": { "CNAME": 5 }, "dnsRecords": [ { "name": "usndpgrantelig.usga.org", "type": 5, "dnsType": "CNAME", "ttl": 60, "rawText": "usndpgrantelig.usga.org.\t60\tIN\tCNAME\twww.google.com.", "rRsetType": 5, "target": "www.google.com." } ] }, { "queryTime": "2023-02-22", "domainName": "coinbase.rest", "dnsTypes": { "CNAME": 5 }, "dnsRecords": [ { "name": "coinbase.rest", "type": 5, "dnsType": "CNAME", "ttl": 598, "rawText": "coinbase.rest.\t598\tIN\tCNAME\twww.google.com.", "rRsetType": 5, "target": "www.google.com." } ] } . . . . ] }curl -X GET 'https://api.apifreaks.com/v1.0/domain/dns/reverse?value=www.google.com&type=CNAME&exact=true&apiKey=API-KEY'
Frequently Asked Questions
value and type, wrapped in reverseDnsRecords. Each entry has a domainName, a dnsRecords array with the resolved record detail (including ttl and raw record text), and a queryTime showing when it was last observed. The response also reports totalRecords, totalPages, and currentPage.type parameter accepts A, AAAA, MX, NS, SOA, SPF, TXT, and CNAME. For A/AAAA you pass an IP or CIDR block; for MX, NS, SOA, SPF, TXT, and CNAME you pass the relevant host or target, with wildcards allowed.value parameter accepts wildcard patterns such as m*.google.com or n*.g*.com to match record families. Set exact=true to restrict results to exact matches for NS, MX, CNAME, SOA, SPF, and TXT; the default (false) returns all matching records.page parameter to walk through totalPages; totalRecords tells you the full count up front so you can size your run.Pricing
To use the Reverse DNS Lookup API, API credits are required. Charges are applied only for successful queries, defined by a 2xx status code. If a request results in a 4xx or 5xx status code, no credits will be deducted, and any credits already charged will be refunded.
For each successful request, 5 credits will be charged to access the Reverse DNS Lookup API. Utilize the Credits Usage API to efficiently monitor your recent consumption of both one-off and subscription credits. This API provides a streamlined way to track and manage your credit usage, ensuring you stay informed about your remaining balance and can optimize your resource allocation effectively.