Going From An IP Address to A Fully Qualified Domain Name (FQDN) In DNSDB

This article is a practical guide to using DNSDB to pivot from IP addresses to FQDNs, illustrating how to query and interpret passive DNS with dnsdbq, dig, and jq. It explains common patterns analysts encounter—single and multiple mappings (simultaneous and sequential), shared hosting, wildcarded domains, third-party pointing, and non-routable/documentation/link-local ranges—while emphasizing the importance of timestamps, bailiwick, and validation with live DNS. Appendices detail querying formal PTR records and recognizing dynamic IP address patterns, providing operational tips to avoid misinterpretation and improve investigative accuracy.