How to Export and Analyze Bulk DNS Lookup Results

Running a bulk DNS lookup across a large list of domains produces a lot of raw material -- addresses, status codes, response times -- fast. The actual value usually comes after the export, once you can filter, sort, and compare it as structured data rather than a page of results scrolling past.

CSV vs. JSON: picking the right export

CSV is the right default for spreadsheet analysis -- sorting by status, filtering to just the failures, or building a quick pivot table to see how many domains fall into each error category. JSON is the better fit when you're feeding the results into another program: a script that diffs this run against last week's, or a pipeline that flags anything resolving into a range it shouldn't.

A few genuinely useful things to check for

• Group by error code first, not just success vs. failure -- an NXDOMAIN and a timeout mean very different things and call for different follow-up.
• Sort by response time to spot domains resolving unusually slowly -- often a sign of a DNS configuration issue worth a closer look on its own.
• Check for domains returning zero addresses of one family but not the other -- a quick way to spot infrastructure that's quietly IPv4-only (or, less commonly, IPv6-only).
• Cross-reference against a previous export of the same list, if you have one, to surface exactly what changed since last time rather than re-reviewing everything from scratch.

Streaming the export directly, rather than waiting for an entire large batch to be built in memory first, is also why this matters from a tooling perspective: it's the difference between a 50,000-row export starting to download immediately versus stalling out mid-request.

A simple diff workflow that scales

The JSON export format makes a genuinely useful comparison almost trivial: load both this run's and last run's export, key each by domain, and walk one set looking for three things -- a domain present in both with a different address list (changed), a domain in the new set but not the old one (added to the portfolio), and a domain in the old set but missing from the new one (dropped, or failed where it used to succeed). That's a script small enough to write in a few minutes, and it turns "did anything change since last week" from a question you'd have to eyeball thousands of rows to answer into one that runs in a second.

Keeping exports themselves as an audit trail

Beyond immediate analysis, each export is worth keeping around on its own merits -- a dated snapshot of exactly what a large domain list resolved to at a specific point in time. When a security incident or a compliance question later asks "what was this domain pointing to on a given date," a retained export answers it definitively, without needing to reconstruct history from memory or hope a change log was kept elsewhere. Storing a handful of past exports costs very little relative to the value of being able to answer that question with certainty rather than a guess.