Research
DNS lookups from dns-research.assetdiscovery.io
If your nameservers see queries from a server named *.dns-research.assetdiscovery.io, they come from us. This page says what we ask, how fast, and how to make us stop.
What these queries are
AssetDiscovery keeps a dataset of internet hostnames and their DNS records, which security teams use to watch their own attack surface. To keep it current, we look up hostnames that are already public: names from certificate transparency logs and other public sources.
The lookups come from our own recursive resolvers, which ask your authoritative nameservers directly. We do not use public or third-party resolvers.
What we ask
For each hostname: A, AAAA and CNAME. For each registered domain: NS, MX, TXT, CAA, SOA and the DMARC record. For addresses we have seen: PTR.
A few lookups of random names under a zone tell a wildcard record from real hostnames.
We send ordinary queries only. No zone transfers (AXFR), no ANY queries, and no guessing of hostnames from these servers.
How fast
Each server sends at most 200 queries per second to any one zone, and a large domain is checked by one server at a time.
A lookup that fails is tried again a day later, at most twice. Most names are checked once every few weeks.
Where the queries come from
A small number of servers whose reverse DNS reads <provider>-<region>-NN.dns-research.assetdiscovery.io, for example do-lon1-01.dns-research.assetdiscovery.io. Today they run at DigitalOcean in London, Amsterdam and Frankfurt.
Their addresses change when a server is replaced, so the reverse name is the reliable way to recognise them.
Opt out
Email support@assetdiscovery.io with the domains you want left alone. Within 24 hours we stop querying every name at or under them.
The same address takes questions and abuse reports. A source address, the time in UTC and the zone help us find the queries quickly.