Technical Forensics

DNS Change History & Passive DNS

Establishing what a domain resolved to at a specific point in the past, independent of its current live DNS records.

Why Passive DNS Matters

Live DNS records only show a domain's current configuration. Passive DNS databases capture historical resolution data collected independently over time by third-party monitoring infrastructure, making it possible to establish what IP addresses, name servers, and mail servers a domain pointed to on a specific past date, even long after those records have changed.

Building a DNS Change Timeline

A DNS change-history report lays out every material change — name server migrations, A/AAAA record changes, MX record changes — against precise dates, then correlates that timeline with content and ownership changes from other sources to determine whether the technical and factual timelines actually line up.

More on This Topic

Related Pages

← Back to Technical DNS & Hosting Forensics

Discuss This With Bill Hartzer