Who else is on that server? Reverse lookups by IP, CNAME, NS and MX

9 November 2026

Turn one IP address, CNAME target, name server or mail server into the full list of hostnames behind it, on the web, as CSV or through the API.

A normal DNS lookup goes from a name to an answer: example.com → 104.18.27.120. A reverse lookup goes the other way: from the answer to every name that points at it.

DigStory does this for four kinds of targets:

Start from	You get
An IPv4 address	Every hostname whose A record points at it
A CNAME target, like `shops.myshopify.com`	Every hostname aliased to it
A name server, like `kay.ns.cloudflare.com`	Every domain delegated to it
A mail server, like `aspmx.l.google.com`	Every domain that receives mail there

Each result comes with the date that hostname first pointed at the target, so you can also see when things arrived.

How to run one

Open Tools, pick the tab (IP address, CNAME, NS or MX), paste the value and press enter. You can also start from a domain page: next to each A record there is a link to everyone else on that address.

What people use it for

Security investigations. One phishing domain is rarely alone. Look up its IP address or its name servers and the rest of the campaign often shows up in the same list, frequently with arrival dates clustered within a few days of each other.

Brand protection. Run your own mail server or CNAME target and check that every hostname on it is one you know about. Forgotten subdomains still pointing at a deprovisioned service are a classic takeover risk.

Sales and market research. Every domain on a provider's mail server is a company using that provider. Every name aliased to a platform's CNAME is a customer of that platform. That is a lead list, with dates showing who joined recently.

Infrastructure clean-up. Before you retire an IP address or a load balancer, look up what still points at it.

Take the list with you

On paid plans the full list is one click away as CSV. The same lookup is available through the API, and the Tools page shows the exact call for whatever you just searched:

curl -H "Authorization: Bearer dg_…" \
  "https://localhost/api/v1/reverse/mx/aspmx.l.google.com"

{
  "data": [
    {"domain": "example.com", "domain_id": 4512, "since": "2026-10-30T19:56:00Z"}
  ],
  "next": 4512,
  "total": 1520
}

Pass next back as ?after=4512 to get the following page. The free plan returns the first 100 results of any reverse lookup; paid plans page through all of them.