Skip to main content

SecurityTrails::Domain: Data collection from SecurityTrails

Overview of SecurityTrails Domain parser


SecurityTrails is the world's largest repository of historical DNS data. It provides data for security companies, researchers, and groups that need to detail, detect suspicious changes in DNS records, and prevent future fraudulent or criminal activity.

A-Parser functionality allows you to save parsing settings for further use (presets), set a parsing schedule, and much more. You can use automatic query replication, substitution of subqueries from files, enumeration of alphanumeric combinations and lists to obtain the maximum possible number of results.

Saving results is possible in the format and structure that you need, thanks to the built-in powerful Template Toolkit templating engine that allows you to apply additional logic to results and output data in various formats, including JSON, SQL, and CSV.

Collected data

  • Alexa rank
  • Apex domain
  • Host
  • Number of subdomains
  • A records
  • TXT records
  • AAAA records
  • Ns records
  • SOA records
  • MX records
  • CNAME records
  • CNAME records pointed here
  • MX records pointed here
  • NS records pointed here
  • Subdomains
  • historical A
  • historical AAAA
  • historical MX
  • historical NS
  • historical SOA
  • historical TXT





Selection of the section (Mode) from which data is collected.

Data is collected from the following pages:

  • Subdomain

  • History



Use cases

  • Obtaining subdomains and their Rank
  • Collecting information about the hosting provider of subdomains
  • Obtaining the mail provider of subdomains
  • Collecting history of A, AAAA, MX, NS, SOA, TXT
  • Collecting DNS records of the domain A, AAAA, MX, NS, SOA, TXT


Domains should be specified as queries, for example:


By default, the results display Query, Alexa Rank, Apex domain - 1 - - 350205 -

Result output options

A-Parser supports flexible result formatting thanks to the built-in Template Toolkit templating engine, which allows it to output results in any form, as well as in structured form, such as CSV or JSON.

Result output for A, AAAA, MX, NS, SOA, TXT records

Result format:

$aRecords.format('$ip, $stats\n')

Example result:, 18037

Result format:


Example result:

v=spf1 ~all

Result format:

$aaaaRecords.format('$ip, $stats\n')

Example result:

2607:f8b0:4004:82a::200e, 17294

Result format:

$nsRecords.format('$ns, $stats\n')

Example result:, 5226, 5233, 5268, 5298

Result format:

$soaRecords.format('$ttl, $email, $stats\n')

Example result:, 147485, 900

Result format:

$mxRecords.format('$p, $host, $stats\n')

Example result:, 13227170, 10, 7665791, 50, 7726366, 40, 12894431, 30, 12975832, 20

Result output for A, AAAA, MX, NS, SOA, TXT records in CSV

Result format:

[% FOREACH soaRecords; 
tools.CSVline(ttl, email, stats);
END; %]

Example result:,147485,900

Subdomain information output

Result format:

$subdomains.format('$domain, $alexa, $hosting, $mail\n')

Example result:, 4, Google LLC, Google LLC, 11, Google LLC,, 18, Google LLC,, 22, Google LLC,, 24, Google LLC,, 27, Google LLC,, 36, Google LLC,, 40, Google LLC,, 44, Google LLC,, 47, Google LLC,, 57, Google LLC

Subdomain information output in CSV

Result format:

[% FOREACH subdomains; 
tools.CSVline(domain, alexa, hosting, mail);
END; %]

Example result:,4,"Google LLC","Google LLC",11,"Google LLC",,18,"Google LLC",,22,"Google LLC",,24,"Google LLC",,27,"Google LLC",,36,"Google LLC",,40,"Google LLC"

Example of JSON output

Initial text

[% data = {} %]

Final text

[% data.json %]

Result format:

data.query = query;
data.subdomains = [];
FOREACH subdomains;
item = {};
item.domain = domain;
item.alexa = alexa; = hosting;
item.mail = mail;
result = {};
result = data;


Example result:

"subdomains": [
"domain": "",
"mail": "Google LLC",
"hosting": "Google LLC",
"alexa": 4
"domain": "",
"mail": "",
"hosting": "Google LLC",
"alexa": 11
"domain": "",
"mail": "",
"hosting": "Google LLC",
"alexa": 18

"query": ""

To make the "Initial text" and "Final text" options available in the Task Editor, you need to activate "More options".

Possible settings

ParameterDefault valueDescription
ModeHistorySite section from which data is collected