Engineering

A Record Lookup API: Check A and AAAA Records in JSON

Retrieve IPv4 and IPv6 DNS records through one documented DNS API response, compare expected web routing, and detect A/AAAA record drift without parsing command-line DNS output.

July 2, 202611 min readEngineering · DNS · A Records · IPv6

Introduction

A and AAAA records are the DNS records most teams notice only when traffic goes somewhere unexpected. They decide which IPv4 and IPv6 addresses a hostname resolves to, which CDN or hosting edge receives web traffic, and whether an application still points at the infrastructure the team expects.

WhoisJSON exposes A and AAAA records through the documented DNS Lookup API /nslookup endpoint. Query a domain or hostname, read the A and AAAA arrays, then compare those values with your expected provider, stored baseline, or domain inventory.

This article focuses on web-routing DNS records. For the broad record-type overview, start with the DNS Lookup API guide. For aliases that point one hostname to another, use the CNAME record lookup API guide.

What Is an A Record Lookup API?

An A record lookup API accepts a domain or hostname, queries DNS, and returns IPv4 address records as structured JSON. In the same response, WhoisJSON can also return AAAA records for IPv6 addresses.

Endpoint used in this guide: GET /api/v1/nslookup?domain=example.com. The OpenAPI schema documents A and AAAA as arrays of strings in the Nslookup response.

The endpoint returns all available DNS fields in one response. There is no A-only endpoint and no type=A parameter in the documented API. Filter A and AAAA client-side when your workflow only needs address records.

Why A and AAAA Records Matter

Address records are simple, but they are operationally sensitive. A single unexpected A record can route users to the wrong origin, bypass a CDN, expose a legacy server, or break a customer-domain onboarding flow.

Web routing

A records map a hostname to IPv4 addresses. AAAA records do the same for IPv6 addresses.

CDN and hosting checks

Compare returned addresses with the expected provider, edge network, or known origin policy.

Drift detection

Store a baseline, then alert when A or AAAA arrays change outside a planned migration.

IPv6 readiness

Check whether a hostname publishes AAAA records before rolling out or auditing IPv6 support.

A vs AAAA Records

A and AAAA records answer the same practical question with different address families: where should traffic for this hostname go?

RecordAddress familyWhoisJSON fieldExample value
AIPv4A203.0.113.10
AAAAIPv6AAAA2001:db8::10
Keep A and AAAA separate. A hostname can publish IPv4 only, IPv6 only, both, or neither. Do not treat an empty AAAA array as an error if the domain is not expected to support IPv6.

Query A and AAAA Records in JSON

Authenticate with Authorization: TOKEN=YOUR_API_KEY and pass the domain or hostname in the domain query parameter.

RequestcURL
curl "https://whoisjson.com/api/v1/nslookup?domain=example.com" \
  -H "Authorization: TOKEN=YOUR_API_KEY"

The response can include many DNS fields. For address-record workflows, read A and AAAA as arrays of strings.

Response shapeJSON
{
  "A": [
    "203.0.113.10",
    "203.0.113.11"
  ],
  "AAAA": [
    "2001:db8::10"
  ],
  "CNAME": [],
  "MX": []
}

Empty or missing A/AAAA arrays can be a valid DNS result. Interpret them against the hostname role and the expected configuration.

How to Interpret A Lookup Results

The correct result depends on whether the hostname is a root website, application subdomain, CDN edge, internal dependency, parked domain, or customer-managed domain.

Expected IPs match

The current DNS answer matches your stored baseline or approved provider list.

Unexpected IP added

Review recent deploys, DNS provider changes, CDN changes, or possible unauthorized modification.

IPv6 missing

Not always a problem. Treat it as a finding only when the service is expected to publish AAAA records.

No address records

May be normal for a CNAME-only hostname, but suspicious for a root or web-serving hostname expected to resolve.

Python Example: Check Web Routing

This example queries /nslookup, extracts A and AAAA records, normalizes the arrays, and compares them with expected values.

a_record_lookup.pyPython
import requests

API_KEY = "YOUR_API_KEY"
BASE_URL = "https://whoisjson.com/api/v1"
HEADERS = {"Authorization": f"TOKEN={API_KEY}"}


def normalize(values):
    return sorted({
        str(value).strip()
        for value in values or []
        if str(value).strip()
    })


def lookup_address_records(domain, expected_a=None, expected_aaaa=None):
    response = requests.get(
        f"{BASE_URL}/nslookup",
        headers=HEADERS,
        params={"domain": domain},
        timeout=10,
    )
    response.raise_for_status()
    data = response.json()

    current_a = normalize(data.get("A"))
    current_aaaa = normalize(data.get("AAAA"))
    expected_a = normalize(expected_a)
    expected_aaaa = normalize(expected_aaaa)

    return {
        "domain": domain,
        "a": current_a,
        "aaaa": current_aaaa,
        "has_ipv4": bool(current_a),
        "has_ipv6": bool(current_aaaa),
        "a_matches_expected": (
            current_a == expected_a if expected_a else None
        ),
        "aaaa_matches_expected": (
            current_aaaa == expected_aaaa if expected_aaaa else None
        ),
    }


print(lookup_address_records(
    "example.com",
    expected_a=["203.0.113.10"],
    expected_aaaa=["2001:db8::10"],
))

Node.js Example: Detect A/AAAA Drift

Store a baseline in your domain inventory. On each scheduled run, compare sets instead of relying on array order.

address-drift.mjsNode.js
const API_KEY = "YOUR_API_KEY";
const BASE_URL = "https://whoisjson.com/api/v1";

function normalize(values = []) {
  return [...new Set(
    values
      .map((value) => String(value).trim())
      .filter(Boolean)
  )].sort();
}

function diff(previous, current) {
  const before = new Set(normalize(previous));
  const now = new Set(normalize(current));

  return {
    added: [...now].filter((value) => !before.has(value)).sort(),
    removed: [...before].filter((value) => !now.has(value)).sort(),
  };
}

async function getAddressRecords(domain) {
  const url = new URL(`${BASE_URL}/nslookup`);
  url.searchParams.set("domain", domain);

  const response = await fetch(url, {
    headers: { Authorization: `TOKEN=${API_KEY}` },
  });

  if (!response.ok) {
    throw new Error(`DNS lookup failed: ${response.status}`);
  }

  const data = await response.json();
  return {
    A: normalize(data.A ?? []),
    AAAA: normalize(data.AAAA ?? []),
  };
}

async function compareAddressBaseline(domain, baseline) {
  const current = await getAddressRecords(domain);
  const aDiff = diff(baseline.A ?? [], current.A);
  const aaaaDiff = diff(baseline.AAAA ?? [], current.AAAA);

  return {
    domain,
    current,
    changed: Boolean(
      aDiff.added.length ||
      aDiff.removed.length ||
      aaaaDiff.added.length ||
      aaaaDiff.removed.length
    ),
    A: aDiff,
    AAAA: aaaaDiff,
  };
}

compareAddressBaseline("example.com", {
  A: ["203.0.113.10"],
  AAAA: ["2001:db8::10"],
})
  .then(console.log)
  .catch(console.error);

A/AAAA Audits for Domain Portfolios

Address-record checks are useful inside a broader domain operations workflow. They answer a narrower question than full inventory: is this hostname resolving to the addresses we expect right now?

  • Production domains: compare A and AAAA records with approved CDN, load balancer, or hosting values.
  • Customer-domain onboarding: verify that the customer has pointed the hostname at the expected address records before activation.
  • Migration review: track old and new address records during hosting or CDN moves.
  • IPv6 rollout: report which domains publish AAAA records and which still only expose IPv4.

For portfolio-wide ownership, expiry, DNS and SSL context, use the domain inventory API guide. For detecting zone updates before comparing record arrays, use the SOA record lookup API guide.

A Records vs CNAME Records

A and AAAA records point directly to IP addresses. CNAME records point a hostname to another hostname. Keep those workflows separate in code because they answer different operational questions.

QuestionUseField
Which IP addresses receive traffic?A/AAAA lookupA, AAAA
Which external hostname or platform is this aliasing to?CNAME lookupCNAME

Many hostnames use one or the other. Some DNS responses can include both alias and address context depending on resolver behavior and the queried name. Preserve the raw response and filter for the fields your workflow needs.

What an A Record Lookup Cannot Prove

It does not return per-record TTL. The documented schema exposes A and AAAA values as arrays of strings, not objects with TTL metadata.
It does not test global propagation. A single API response is not a multi-resolver or multi-region propagation report.
It does not identify IP reputation. Address records show where DNS points. They do not score whether an IP is malicious, clean, residential, cloud-hosted, or blocked.
It does not prove the web service is healthy. DNS resolution is not an HTTP uptime check, TLS validation, or application health probe.
It does not expose an A-only endpoint. Use /nslookup and filter the A and AAAA arrays client-side.

FAQ

What is an A record lookup API?

It queries DNS A records for a domain or hostname and returns IPv4 addresses as structured JSON. With WhoisJSON, the same /nslookup response can also include AAAA records for IPv6.

Which WhoisJSON endpoint returns A and AAAA records?

Use GET /api/v1/nslookup with the domain query parameter, then read the A and AAAA arrays from the JSON response.

Does WhoisJSON have a separate A-only endpoint?

No. The documented DNS endpoint returns available DNS record types in one response. Filter A and AAAA client-side when your workflow only needs address records.

Does an A record prove that a website is online?

No. An A record only shows DNS resolution to an IPv4 address. Website health still depends on routing, firewall rules, TLS, HTTP service state, and application behavior.

Can I use A and AAAA records for IPv6 readiness checks?

Yes. Read the AAAA array to identify hostnames that publish IPv6 addresses, then combine that with your own service and application tests before declaring IPv6 support complete.

Conclusion

An A record lookup API gives teams a clean way to inspect web-routing DNS records in code. Use /nslookup, read A and AAAA arrays, compare values as sets, and store baselines for domains where unexpected routing changes matter.

Keep the boundary precise: A and AAAA records show address resolution. They do not prove propagation, uptime, IP reputation, or service health. Combine them with CNAME, SOA, SSL, subdomain discovery and inventory workflows when you need the full domain operations picture.

Check A and AAAA records with WhoisJSON

Query IPv4, IPv6, CNAME, MX, TXT, SOA, CAA, DMARC, BIMI, MTA-STS and TLS-RPT records in one JSON response.

Check DNS RecordsView Documentation
DNS Address Records

Audit A and AAAA Records in One API Call

Retrieve IPv4 and IPv6 records together with CNAME, MX, TXT, SOA, CAA and email security records.

A and AAAA arraysIPv4 and IPv6 checksPython and Node.js1,000 free requests/month