Passive DNS

Passive DNS (pDNS) is a store of DNS resolutions observed in the wild and saved over time. Sensors near recursive resolvers capture which name resolved to which address and when, then aggregate that data. Querying a pDNS database returns the history of a domain: every IP it has pointed to, the subdomains seen under it, and the other domains that have shared an address.

This matters for recon because it reveals infrastructure the target no longer advertises. A subdomain removed from live DNS today may still appear in passive records, exposing a forgotten host worth checking. Analysts also pivot from an IP to every domain that ever resolved there, mapping shared hosting or an attacker's infrastructure.

Because the lookup hits a third-party dataset and never the target's own servers, passive DNS is a core part of passive recon. It complements active dns enumeration and broadens subdomain enumeration by surfacing names no wordlist would guess. Threat intelligence teams lean on it to track adversary infrastructure across time.

In Trickest you can query several pDNS providers in one workflow, merge the results with active resolution, and produce a unified history of a target's footprint.