The reverse DNS name of every address.
Every IPv4 and IPv6 address that answers a PTR query, with the host name it returns, from our own scans of the whole address space. The file is rebuilt weekly.
Schema at a glance.
See documentation →The schema and metadata are in the docs. It is published as CSVGZ.
| ip | domain |
|---|---|
| 1.1.1.1 | one.one.one.one |
| 8.8.8.8 | dns.google |
| 9.9.9.9 | dns9.quad9.net |
| 24.28.1.1 | syn-024-028-001-001.res.spectrum.com |
| 2a01:4f8:c012:6b8e::1 | server-ipv6.clients.your-server.de |
Downloading it from code.
Database API reference →One call gets you the current IP RDNS build. Every official client wraps it three ways: straight to disk, a time-limited link you hand to your own runner, or bytes in memory, and checksums() returns the published digests to verify it against.
download()downloadUrl()downloadBytes()metadata()checksums()import osfrom internetdata import InternetDataclient = InternetData(os.environ["INTERNETDATA_API_KEY"])# what is in today's build, without moving the filemeta = client.database.metadata("ip_rdns_v1")client.database.download("ip_rdns_v1", "csvgz", "./ip_rdns_v1.csv.gz")sums = client.database.checksums("ip_rdns_v1", "csvgz")print(meta.updated, meta.entries, sums["sha256"])
Getting your hands on it.
Teams join IP RDNS against traffic they already log, inside their own infrastructure, and never send an address anywhere to get an answer.
Traffic context
A host name often says what an address is: a residential line, a mail server, a cloud instance.
Log enrichment
Name every address in a log without a PTR query per row.
An official client for every major language.
All SDKs on GitHub →Twelve official clients for the languages you ship in, each wrapping the database endpoints: list what you're licensed for, poll a build, follow the download redirect and verify what landed. Install commands are in the docs.
What does a row tell us?
One address and the host name its PTR record returns. An address with no PTR record isn't in the file.
Where does it come from?
Our own internet-wide scans, asking each address for its PTR record.
What can a host name tell us?
Often what an address is: a residential line, a mail server, a cloud instance, and sometimes the city it's in.
How often is it rebuilt?
Weekly. The metadata call answers when the current build landed and how many rows it holds, before you fetch it.
Which formats does a build ship in?
Gzipped CSV. Each row is one address, so a prefix tree would not make it smaller. Poll the metadata call first and fetch only when the build has changed.
What if a row looks wrong?
Send it to us and we'll tell you what we hold on it, when we last saw it and how. Corrections land in the next build.
Test the real build first.
An evaluation license puts a full current build in your hands, with no sampling, so you can measure it against your own traffic before anyone talks about terms.