This article covers the Passive DNS (PADNS) family of data sources in SPQL. These models provide historical DNS resolution data, including specialized variants for dangling records, name chains, nameserver observations, and TLD-level metrics.
Passive DNS (PADNS family)
Passive DNS observations. Core fields typically include:
Field | Type | Description |
|---|---|---|
query | string | Queried name |
answer | string | Answer value |
type | string | Record type (A, AAAA, MX, NS, CNAME, etc.) |
first_seen | datetime | First observation |
last_seen | datetime | Most recent observation |
asn | number | ASN associated with the answer |
Specialized variants add fields for dangling records, name chains, NS-specific data, and TLD/RD metrics. The padns_api model supports additional query parameters.