Passive DNS - Common Output Format
==================================

This document describes the output format used between Passive DNS query interface. The output format description
 includes also a common meaning per Passive DNS system.

This format originated as a discussion between Aaron Kaplan, Paul Vixie, Henry Stern and Alexandre (Adulau) in ~ 2011.
It was submitted to the IETF in 2014 and since then had a few minor updates.

It is being used by multiple operators of passive DNS services to offer an identical output format for queries to a passive DNS database.
This allows the person issuing the query to combined and/or compare results.

The output format is in JSON.

How to Contribute to the Document
---------------------------------

You can make pull request to the xml document. We are looking for comments from passive DNS developers in order to improve the document.


IETF Internet-Draft
-------------------

- [Version 9 published as Internet-Draft](https://datatracker.ietf.org/doc/draft-dulaunoy-dnsop-passive-dns-cof/) - 11 February 2022


Users and Use-cases
--------------------

  * [CERT.at](https://pdns.cert.at)
  * [Farsight](https://farsightsecurity.com)
  * [CIRCL](https://www.circl.lu/services/passive-dns/)
  * [D4 Project Passive DNS](https://www.d4-project.org/2019/05/28/passive-dns-tutorial.html)
  * [balboa](https://github.com/DCSO/balboa)
  * [mnemonic](https://docs.mnemonic.no/display/API/Passive+DNS+Simplified+Integration+Guide)
  * ... add yours please. Create a pull request to this file please.