Passive DNS Exchange


This group works to define a common output format of Passive DNS Servers which clients can query. Over time, since the initial announcement of Passive DNS replication at the 17th Annual FIRST Conference on Computer Security by Florian Weimer, multiple Passive DNS Implementations were developed. This standard proposes a common output format to make Passive DNS information more universally useable.


The initial goal of this SIG was to collaboratively develop a common output format (COF) for Passive DNS data. As a result of this SIG, an Internet Draft was published on September 9th 2014.

The lastest version can be found on the IETF site. The source code of the standard can be found on github. Change requests or discussions are welcome on github or on the mailing list.


Apart from definining the standard, farsight and the group added a MISP module called cof2misp which can import COF into MISP. There, the full power of the MISP correlation engine can be employed to find matching indicators of compromise. Therefore, by importing the COF format into MISP, we can pivot back and forth between passive DNS databases and MISP.

If you want to try out the cof2MISP module and if you are a member of FIRST, the instance has the cof2MISP module installed, and you can try correlating events. If you need to get access to passive DNS DB servers, you can ask:

Status quo

Next steps


Request to Join