DNS History: Zone Files vs Resolver Checks
For DNS history, dated zone files are generally more reliable than a resolver check because they capture the authoritative record at a specific point in time, while a resolver check only shows the current cached or live answer, which can be influenced by TTLs, caching layers, and propagation delays. This article explains the difference, when to use each, and how to interpret the results.
What DNS History Means
DNS history refers to the past records of a domain — the IP addresses, name servers, and other resource records it has pointed to over time. This data is used for security investigations, domain ownership disputes, infrastructure changes, and understanding a domain’s reputation. Two common ways to look at DNS history are: (1) querying a resolver for the current answer, and (2) accessing a historical zone file archive. The key difference is that a resolver check is a live snapshot, while a zone file is a dated record of the authoritative response.
How a Resolver Check Works
When you query a DNS resolver (like 8.8.8.8 or your ISP’s resolver), you get the answer that resolver has cached or fetched from the authoritative server. That answer includes a Time-To-Live (TTL) value, which tells the resolver how long to keep it. Resolver checks are useful for:
- Seeing what most users currently see when they visit the domain.
- Checking propagation of a recent change.
- Debugging DNS issues in real time.
However, a resolver check does not give you history. It only shows the current state, and that state can be stale due to caching. You can force a fresh query by using a tool like dig with the +trace flag or by querying the authoritative server directly, but that still only gives you the present record, not what it was last week or last year.
What a Dated Zone File Is
A zone file is a text file that contains the DNS records for a domain. Authoritative name servers use zone files to answer queries. A dated zone file is a snapshot of that file taken at a specific time, often stored by passive DNS databases or backup services. These snapshots are timestamped, so you can see exactly what the authoritative records were on that date. Examples of sources include:
- Passive DNS databases (e.g., from security vendors).
- Domain history services that crawl and store zone data.
- Your own backups if you run a DNS server.
Because these are actual copies of the zone, they are not affected by caching or TTLs. They represent the truth as published by the authoritative server at that moment.
Why Zone Files Beat Resolver Checks for History
The primary reason zone files are superior for historical analysis is that they are immutable once recorded. A resolver check is ephemeral — it changes as records change and caches expire. If you want to know what IP a domain pointed to on March 15, 2023, a resolver check today cannot tell you that. A dated zone file can. Additionally, zone files contain the full set of records (A, AAAA, MX, NS, TXT, etc.) as they were, whereas a resolver check typically only returns the specific record type you ask for. This makes zone files more comprehensive for forensic analysis.
When a Resolver Check Is Still Useful
Despite the superiority of zone files for history, resolver checks have their place. They are essential for:
- Verifying that a change has propagated to the wider internet.
- Diagnosing why a user might be seeing an old IP (due to caching).
- Checking the current state of a domain that you don’t have historical data for.
If you are doing a one-off check on a domain you suspect has changed, a resolver query is fast and free. But for any investigation that requires knowing what was true in the past, you need a dated zone file.
Common Problems and Misconceptions
A common misconception is that a resolver check with a short TTL gives you a “fresh” historical answer. That is false — even a fresh query only reflects the present. Another issue is that some “DNS history” websites actually use resolver checks over time and store the results, but those are only as good as the frequency of the checks. If a domain changes multiple times between checks, you miss records. Zone file archives are more reliable because they capture the authoritative source directly.
Another problem is that not all zone files are publicly available. Passive DNS databases are often proprietary and require a subscription. However, some free services offer limited historical data, and you can also check the Wayback Machine for cached DNS records (though that is not a true zone file).
How to Choose the Right Method
When deciding between a resolver check and a dated zone file, consider the following:
- Need historical data? Use a dated zone file.
- Need current data? Use a resolver check.
- Need full record set? Use a zone file.
- Need speed and zero cost? Use a resolver check.
- Investigating an incident? Use a zone file to establish a timeline.
In practice, security analysts and domain investigators almost always prefer zone file archives for any serious work. Resolver checks are for quick lookups, not for history.
Costs and Alternatives
Resolver checks are free and available from any DNS tool. Dated zone files are often part of commercial threat intelligence platforms, which can be expensive. Free alternatives include the Wayback Machine (for historical web pages, not DNS), and some open-source passive DNS projects. For your own domains, you can set up logging to capture zone transfers or use a service that archives your zone files automatically.
Frequently Asked Questions
Can I get DNS history from a regular DNS lookup?
No. A regular lookup only shows the current answer. To get history, you need a source that has stored past records, such as a passive DNS database or a zone file archive.
Why do some DNS history tools show different results?
Different tools use different data sources. Some use resolver checks over time, which can miss changes. Others use authoritative zone file snapshots, which are more accurate. Also, some tools only store certain record types.
How far back does DNS history go?
It depends on the source. Some commercial databases have data going back to the early 2000s. Free sources may only have a few years. For your own domains, you can keep records indefinitely.
Are zone files always accurate?
Zone files are accurate as of the time they were captured, but they can be missing if the capture process skipped a change. They are the best available record, but not perfect.
Can I use a resolver check to see if a domain has changed?
Yes, but only if you have a previous record to compare against. If you don’t have a baseline, a resolver check tells you nothing about history.
What is the difference between a zone file and a DNS cache?
A zone file is the authoritative source on a name server. A DNS cache is a temporary store on a resolver. The cache can be stale; the zone file is the truth at that moment.
Related
Method: the standard formula for this calculation, rounded as each result states. See how the calculators work or report an error.