Complete IPv4 Reverse DNS.
Updated Daily.
Every day, ELLIO scans the entire routable IPv4 address space and delivers ~1.25 billion clean PTR records - no noise. Full historical archive included.
PTR records in dataset
IPv4 addresses scanned
rDNS scan frequency
Clean PTR records only.
Every record in the dataset is a valid PTR response - ready for ingestion. Error responses and IPs without PTR records are excluded.
Full historical archive.
Daily rDNS datasets are available since January 1, 2026. Compare PTR records across days, weeks, or months to track infrastructure changes over time.
JSONL format with bulk download.
Each snapshot is delivered as JSONL - one JSON object per line with the IP address and all associated PTR values.
Data format
Each record is a JSON object containing the IP address and an array of all PTR values returned for that address. Delivered as JSONL (one record per line).
Most IPs resolve to a single PTR record, but some return multiple values - the dataset preserves all of them.
Security triage and investigations
PTR hostnames reveal whether an IP is cloud, ISP broadband, colo, or enterprise - adding immediate classification context to SIEM, TIP, and SOAR pipelines. Diff records across daily snapshots to track infrastructure churn, reassignments, and hosting changes over time.
Network and cloud asset monitoring
Track PTR changes across your own IP ranges and your vendors' to catch unauthorized host additions, naming drift, or infrastructure that quietly moved without a change ticket. Daily diffs make it easy to spot what changed and when.
Ad fraud and infrastructure classification
PTR patterns strongly suggest whether an IP is a data center or last-mile broadband - a key signal for invalid traffic scoring alongside industry efforts like the TAG Data Center IP List. The same classification powers geolocation enrichment, compliance verification, and network topology mapping.
Email deliverability and anti-spam
Google and Yahoo sender guidelines call out valid reverse DNS and forward/reverse consistency as key deliverability signals. Use the dataset to find IPs missing PTR, with generic PTR, or failing consistency checks - across your own fleet and your vendors.
How does this compare to Rapid7 Project Sonar?
Project Sonar publishes reverse DNS datasets covering the IPv4 address space, but with different access terms and update cadence. Between January 1 and March 1, 2026, Project Sonar published 7 rDNS snapshots - ELLIO published 60. If your workflows depend on consistent, high-frequency updates with straightforward access, ELLIO is built for that.
How does this compare to per-query rDNS APIs like WhoisXML API?
API-based providers like WhoisXML API charge per lookup - their top tier offers 40,000 API calls for around $22,900/year. That covers a tiny fraction of the IPv4 space and adds latency to every enrichment pipeline.
ELLIO gives you the full dataset - ~1.25 billion records daily - for $12,000/year. Load it as a lookup table in your SIEM, build an internal enrichment service, or run batch analysis across the entire address space - no API round-trips, no per-query costs, no rate limits.
If you're enriching millions of IPs per day, owning the dataset isn't just cheaper - it's architecturally better.
How is the data delivered?
By default, we push each new dataset directly to your S3-compatible storage bucket. You provide credentials, and we handle the rest.
If you prefer to pull (download) datasets instead, that option is available. Each contract includes up to 1,095 downloads per year (3 downloads per dataset per day, across 365 days) - enough to re-download any snapshot up to three times on average.
What is the update SLA?
Our SLA guarantees at least one dataset per week. In practice, we deliver daily snapshots - and have done so consistently. However, during large-scale internet events or infrastructure disruptions, daily delivery may occasionally be interrupted. The weekly guarantee ensures you always have a contractual baseline you can depend on.
What license does the dataset come with?
The default license covers internal use within your organization - security operations, threat intelligence, research, and infrastructure monitoring.
If you need a resale license - for example, to redistribute the data as part of a commercial product or managed service - please contact us to discuss terms.
What format is the data in?
Each snapshot is a single JSONL file (one JSON object per line), compressed with Zstandard (zstd). Every record contains an ip field and a ptr array with all associated PTR values. Compressed snapshots are approximately 18 GB.
How do I decompress the data?
zstd -d rdns_dataset_2026-01-20.jsonl.zst
Or stream without writing the uncompressed file:
zstdcat rdns_dataset_2026-01-20.jsonl.zst | head -n 10
Install with apt install zstd, brew install zstd, or equivalent for your OS.
Do you cover IPv6?
Currently, the dataset covers the full routable IPv4 address space only. If you're interested in IPv6 rDNS coverage, reach out - we'd like to hear about your use case.
How far back does the historical archive go?
Daily rDNS datasets are available since January 1, 2026.