Pivot map
Pivot from here
Outputs from DNS History can become inputs for the next tool. These are the most relevant follow-on pivots in the library.
A global, open, stable, and secure Internet that serves the entire Asia Pacific community
ARIN is a nonprofit, member-based organization that administers IP addresses & ASNs in support of the operation and growth of the Internet.
AbuseIPDB provides IP reputation data and community abuse reports for identifying malicious hosts in network and threat investigations.
AccountKiller provides direct deletion links and step-by-step instructions for removing accounts on hundreds of websites and social platforms.
Investigator Use
DNS History provides historical DNS record data for domains, allowing investigators to view the A, MX, NS, and other records that a domain has used over time. Historical DNS data is a critical OSINT technique for uncovering real IP addresses hidden behind CDNs, tracking infrastructure changes, and understanding a domain's operational timeline.
What investigators use DNS History for: finding the original IP address of a domain before it was moved behind Cloudflare or another CDN, tracking when a domain changed hosting providers, discovering name server changes that may indicate a domain transfer or seizure, and building a timeline of a domain's infrastructure evolution.
What DNS History exposes: A records showing historical IP address mappings with date ranges, MX records revealing email server history, NS records showing name server changes over time, and CNAME records for domains that have pointed to third-party services. Each record includes timestamps showing when the configuration was active.
The most common use case for DNS History in OSINT is origin IP discovery. When a domain operator moves to Cloudflare or a similar reverse proxy, all DNS queries return Cloudflare's IP addresses rather than the actual server. However, DNS History often captures the A record that existed before the CDN was configured, revealing the real hosting IP. That IP can then be queried in Shodan to enumerate exposed services and potentially identify the hosting provider.
Timeline analysis: DNS record changes create a timeline of a domain's operational history. A domain that changed name servers from a reputable provider to an obscure one may have been transferred to a new operator. Sudden changes in A records around the date of a known incident can help establish a timeline of malicious infrastructure deployment.
Limitations: DNS History's coverage depends on passive DNS sensors that captured records during each time period. Domains with low traffic or those protected by registrar DNSSEC policies may have limited historical data. Coverage depth varies by domain — heavily trafficked domains typically have more complete records.
In a workflow: after identifying a domain through OSINT collection, check DNS History alongside SecurityTrails and PassiveDNS sources. Use discovered historical IPs in Shodan to enumerate exposed services. Cross-reference NS record history with WHOIS registration changes to understand domain ownership transitions.
Before You Pivot
Capture the target, search terms, and why this source is relevant before you leave the page.
Archive volatile pages, save screenshots, and keep timestamps for anything that may change.
Treat one tool as a lead source. Confirm important findings with independent sources.
Related tools
ARIN is a nonprofit, member-based organization that administers IP addresses & ASNs in support of the operation and growth of the Internet.
Free online network tools, including traceroute, nslookup, dig, whois, ping, and our own Domain Dossier and Email Dossier. Works with IPv6.
An open source intelligence tool to crawl the graph of certificate Alternate Names
Finds certificates and subdomains using Certificate Transparency data. An alternative to crt.sh that presents the information a bit differently.
DNS Twister generates and monitors domain permutations for typosquatting detection, brand protection, and phishing infrastructure discovery.
Free DNS, WHOIS, and email-authentication lookups for any domain: SPF analysis with the 10-lookup limit check, DKIM selector discovery, DMARC checks, email header analysis, and blacklist checks. Results explain in plain English what each record means. No account needed for basic lookups; free API tier available.