Passive DNS Monitoring#

The PassiveDNSMonitor polls passive DNS databases for historical resolution data on your domains. PDNS visibility is one of the earliest external signals that someone outside your operation has started investigating a domain.

What It Detects#

Event Type	Severity	Trigger
`domain_flagged`	warning	Domain appears in PDNS at all on the first poll (someone resolved it externally)
`new_record`	warning	New A/AAAA records appear that weren’t in the baseline
`nxdomain_spike`	critical	Burst of NXDOMAIN responses - possible zone takedown or resolver-level blocking

PDNS Providers#

Provider	API	Auth	Notes
CIRCL	`circl.lu/pdns/query/{domain}`	HTTP basic auth	Free with a CIRCL account. Returns NDJSON. Default provider.
`local`	n/a	n/a	No upstream. Only ingests observations from InfraGuard’s own DNS listener. Useful for testing or self-telemetry.

Configuration#

passive_dns:
  enabled: true
  provider: "circl"
  interval_hours: 6
  circl_user: "${CIRCL_USER}"
  circl_password: "${CIRCL_PASSWORD}"
  alert_on_first_seen: true
  nxdomain_spike_threshold: 5
  nxdomain_window_seconds: 3600
  domains:
    - "cdn.example.com"
    - "static.example.com"

How It Works#

Baseline Establishment#

On the first poll for each domain, the monitor records all existing PDNS records without alerting. This becomes the baseline. Subsequent polls only alert on records that weren’t present in the baseline.

If alert_on_first_seen: true, the first poll also fires a domain_flagged event letting the operator know the domain already has external PDNS visibility.

New Record Detection#

After the baseline is established, new A/AAAA records trigger a new_record alert. CNAME and TXT record changes are tracked but don’t generate alerts (they’re too noisy).

New records could mean:

A sinkhole provider is answering for the domain
The registrar took action on the zone
DNS hijacking
The operator’s own DNS change is now visible globally

NXDOMAIN Spike Detection#

When the DNS listener observes NXDOMAIN responses for a monitored domain, the monitor tracks the count in a sliding window. Exceeding the threshold (default 5 in 3600s) fires a critical alert.

An NXDOMAIN spike usually means the registrar or registry pulled the zone (takedown), or a major resolver started refusing to resolve it.

Integration with DNS Listener#

InfraGuard’s DNS listener can feed local observations directly into the PDNS monitor:

monitor.record_observation("cdn.example.com", "A", "1.2.3.4")
monitor.record_observation("cdn.example.com", "NXDOMAIN", "")

This works even with provider: "local" for deployments that don’t have CIRCL access.

Burn Detection Integration#

PDNS events feed into the BurnDetector as BurnIndicator objects with type pdns_domain_flagged, pdns_new_record, or pdns_nxdomain_spike. The burn scoring engine picks these up and factors them into the domain’s confidence score.

API#

# Get PDNS monitor status
curl -H "Authorization: Bearer $TOKEN" https://ig:8080/api/pdns/status

# Get recent PDNS events
curl -H "Authorization: Bearer $TOKEN" https://ig:8080/api/pdns/events?limit=20

# Get observation history for a domain
curl -H "Authorization: Bearer $TOKEN" https://ig:8080/api/pdns/history/cdn.example.com

# Clear history and re-baseline
curl -X POST -H "Authorization: Bearer $TOKEN" \
  https://ig:8080/api/pdns/clear?domain=cdn.example.com

Memory Management#

Per-domain observation history is capped at 500 records. When exceeded, the oldest record is evicted.
The event ring buffer holds the most recent 200 events.
NXDOMAIN timestamps are tracked per-domain in sliding window deques.