A DNS query tells you what a name resolves to now. Passive DNS tells you what it has resolved to before — which is frequently the more informative of the two, and is the only way to see a record that has already been withdrawn.
What it is
Resolvers observe answers as they pass and record them. Aggregated across many resolvers over time, that becomes a history of what each name resolved to and when. It is observational rather than authoritative: it records what was seen, not what was published.
suspicious.example A 203.0.113.10 first seen 2026-08-02
last seen 2026-08-09
suspicious.example A 198.51.100.4 first seen 2026-08-09
last seen 2026-08-21
suspicious.example MX mail.attacker.example
first seen 2026-08-03
last seen 2026-08-20
Today: no records at all.Everything in that history is invisible to a live query today. The MX in particular — present for seventeen days, now gone — is the evidence that would have changed the assessment and cannot be obtained any other way.
Questions only history answers
| Question | Why a live query cannot answer it |
|---|---|
| Did this domain ever have an MX? | It was removed before you looked. |
| How long has it been active? | Current records carry no age. |
| What else shared that address? | The address may since have been reassigned. |
| Was this dormant and then activated? | A gap in the history is the signal, and a live query has no history. |
| What did the dangling CNAME point at? | The target is gone; the history says what it was. |
Limits worth stating
- Coverage is partial. A record only appears if somebody queried it through a contributing resolver. Low-traffic names are sparsely recorded or absent.
- Absence proves nothing. No record in the history does not mean no record existed.
- Timestamps are first-seen and last-seen, not created and deleted. A record may have existed before anyone queried it.
- It is a commercial or community dataset, not something you can derive yourself from the DNS.
Snapshot your own observations as you go
When you find a suspicious domain, record what it resolves to at that moment — addresses, MX, nameservers, certificate. It costs one command, it is admissible in an abuse report, and it is the only history you are guaranteed to have when the records disappear overnight.