Domain Zone Files and Research: Mining Registration Data

Zone files are the raw data of the domain name system. They contain every registered domain name within a TLD along with its associated nameserver records and IP addresses. For domain investors, zone file access represents the most comprehensive data source available for market research, trend analysis, and identifying acquisition opportunities that never appear on public expired domain lists.

What Zone Files Actually Contain

A DNS zone file is a plain text file that maps domain names to DNS resource records within a specific TLD. The .com zone file, for example, contains an entry for every registered .com domain along with its authoritative nameservers. The file does not contain WHOIS registration data like owner names or contact information. It strictly records the DNS delegation: which domain name points to which nameserver.

Each entry includes the domain name, a TTL (time-to-live) value typically set to 172,800 seconds (48 hours), the record type (NS for nameserver), and the nameserver hostname. This tells DNS resolvers where to find authoritative answers for queries about that domain.

The .com zone file is massive. Verisign, the registry operator for .com and .net, publishes updated zone files daily. As of early 2025, the .com zone contains approximately 160 million entries, making the uncompressed file roughly 20 GB. The .net zone is smaller at around 13 million entries.

ICANN Centralized Zone Data Service

ICANN operates the Centralized Zone Data Service (CZDS) at czds.icann.org, which provides a single portal for requesting zone file access across participating generic top-level domains. Rather than contacting each registry individually, researchers submit one application through CZDS and receive approval decisions from each registry operator independently.

As of 2025, CZDS offers access to over 1,100 TLD zone files. Roughly 1,080 have been approved for general access, around 55 remain pending, and a small number have been denied or revoked because the TLD is no longer active. The major legacy TLDs (.com, .net, .org) have their own access processes separate from CZDS, though the application procedure is similar.

How to Apply for Access

The application process requires a legitimate use case. ICANN and individual registry operators evaluate each request based on the stated purpose and the applicant’s understanding of acceptable use policies. Approved use cases include security research, academic analysis of domain registration patterns, brand protection monitoring, and market analysis for business planning.

Create an account at czds.icann.org, complete the application form describing your intended use, and submit. Each registry operator reviews your request independently, so you may receive approval for some TLDs and denial for others. The review process typically takes one to four weeks.

Once approved, you can download zone files for your authorized TLDs once per 24-hour period. Files are updated daily, typically between 00:00 and 06:00 UTC. Access is granted for a minimum of three months, after which you may need to renew depending on registry policy.

For .com and .net zone files specifically, access is provided through Verisign’s TLD Zone File Information program, which requires agreeing to acceptable use terms that prohibit using the data for unsolicited marketing or WHOIS harvesting.

Research Applications for Domain Investors

Zone file data enables several powerful research workflows that are not possible through standard aftermarket tools.

New registration monitoring. By comparing consecutive daily zone file snapshots, you can identify every domain newly registered in a TLD. This reveals what niches, keywords, and trends other investors and businesses are pursuing in real time. A sudden surge of registrations containing a specific keyword signals market interest worth investigating.

Nameserver analysis. Grouping domains by nameserver reveals which hosting providers, parking services, and development platforms are gaining or losing market share. Domains pointed to parking nameservers like Sedo’s or Afternic’s are identifiable, letting you estimate the size of the parked domain market within any TLD.

Drop prediction. Domains that change nameservers to a registrar’s default holding nameservers or to nameservers associated with deletion pipelines often indicate the domain is about to be dropped. Monitoring these patterns gives you advance notice to place backorders before the domain enters the public deletion queue.

Portfolio intelligence. Tracking zone file entries for domains owned by major portfolio holders (identified by shared nameservers) lets you monitor their acquisition and divestment patterns. When a large investor adds 50 new domains in a specific niche, that intelligence helps you evaluate whether the niche is worth entering or already saturated.

Technical Requirements

Processing zone files at scale requires more computing resources than a standard laptop typically provides. The .com zone file alone demands significant disk space and substantial RAM for efficient parsing. Most researchers use scripted workflows on servers or cloud instances.

Python is the most common language for zone file analysis. Libraries like dnspython parse zone file records efficiently, and combining them with pandas for data analysis enables complex queries across millions of records. A basic pipeline downloads the daily zone file, parses it into a structured format, compares against previous days to detect additions and deletions, and flags domains matching your criteria.

For investors without programming skills, commercial tools provide zone file analysis through web interfaces. DomCop aggregates expired domain data from zone files and adds metrics like Moz DA, Ahrefs DR, and Majestic Trust Flow. ExpiredDomains.net performs similar aggregation with filters for domain age, backlink profile, and TLD.

Acceptable Use and Ethics

Zone file access comes with explicit terms of use that carry real enforcement consequences. Using zone data to compile mailing lists, send unsolicited emails, or conduct bulk WHOIS harvesting for marketing violates the terms and results in access revocation. ICANN and registry operators audit usage patterns and have revoked access for violators.

Legitimate uses include analyzing registration trends, identifying market opportunities, conducting security research, and performing brand protection monitoring. Selling or redistributing raw zone file data is prohibited under most access agreements. You can publish analysis and aggregated statistics derived from zone files, but distributing the files themselves is not permitted.

Start your CZDS application with a clear, specific research purpose. Begin with smaller TLDs like .io, .ai, or .xyz to build your workflow before tackling the .com zone file.

For more on DNS infrastructure that zone files document, see DNS explained for domain investors. To understand nameserver configuration for your own domains, check out domain CNAME and A records explained.