Sensors on participating networks note the DNS answers that resolvers receive: the name, the answer, and when it was first and last seen. Nothing is asked of the domain itself, so the history shows what people were actually sent. It only covers names those networks' users looked up.
Reading the timeline.
Each step is a network (the company announcing the addresses) and the span its addresses were seen; a gap of over a year starts a new step.
The network is the one that announces the address today. For cloud and hosting ranges that rarely changes, but an address can move to a new owner over the years.
A very short period on an unexpected network is often a wrong answer from a filtering or hijacked resolver, not a real move.
"Seen" counts how many times the sensors recorded the answer; busy sites reach millions.
Questions people ask.
What is DNS history?
A record of the answers a domain's DNS gave in the past: the IP addresses it pointed to, its aliases, and when. It comes from passive DNS, where sensors on networks note the answers resolvers receive and when each was first and last seen.
Where does the data come from?
From mnemonic's public passive DNS: records marked TLP:WHITE, which mnemonic offers to the public and which may be shared freely. Today's records come from live DNS, and the network behind each address from Team Cymru's IP to ASN mapping.
Why is my domain missing?
Passive DNS only sees names that the users of its sensors' networks look up. Small, new or rarely visited sites are often not in it, and that says nothing about the domain.
Does it show old name servers and mail servers?
Only what passive DNS saw, which is mostly addresses and aliases. For the registration record use WHOIS, and for old versions of the website the domain history tool.
Why does the history list a network the site never used?
Passive DNS records what resolvers were told, and filtering or hijacked resolvers sometimes answer with their own address. A short, isolated period on an unexpected network is usually one of those.
Hivex index
Short names, still free to register.
Starting something new? Hivex keeps a live index of short, brandable .si names nobody has claimed yet, each checked with the registry.
Hivex's free JSON API and MCP server check domains, DNS and registration records from your own code or from AI assistants that speak MCP. No key needed.
By Hivex. Updated 11 October 2026. Past records come from mnemonic's public passive DNS and are kept up to a day; today's records are read live. The names you search are not stored.
letsencrypt.org · DNS history
Checked 09:22:31 UTC · mnemonic passive DNS · live DNS
First seen
12 February 2015
Addresses seen
867
Networks
5
Now on
Amazon.com, Inc.
Note: Passive DNS records what resolvers were told, including the odd wrong answer from a filtering or hijacked resolver; a short, isolated period is often one of those.
Good: Since 12 February 2015, letsencrypt.org has pointed to 867 addresses on 5 networks; today it is on Amazon.com, Inc.
Hosting over time
Network of each address
Note: Unknown network27 February 2015 to 5 October 2026 · 23.214.121.158, 23.207.22.70, 23.46.121.108 and 367 more
Note: Akamai International B.V.30 June 2015 to 29 September 2019 · 172.231.122.39, 96.6.13.184, 23.78.58.76 and 10 more
Note: Akamai Technologies, Inc.18 December 2015 to 12 July 2019 · 2.21.204.150, 23.9.220.94, 92.123.198.214 and 2 more
Note: DigitalOcean, LLC30 September 2019 to 22 February 2021 · 142.93.108.123, 167.99.137.12, 167.99.129.42 and 5 more