ICANN zone file access works one extension at a time: you create an account on ICANN's Centralized Zone Data Service (CZDS), request the zone file of each generic TLD you want, and the registry that runs that TLD approves or denies the request. Once approved, you can download each file once per 24 hours. Country-code extensions such as .uk, .de or .io are not part of it.
What a zone file is
A zone file is the registry's list of the names in an extension that are active in the DNS, with the nameservers each one points to. If a domain resolves, it is in the zone. If it has no nameservers or has been pulled from the DNS, it is not.
Verisign, which runs .com, .net and .name, describes its files as containing "mapping data for active second-level domain names" together with the IP addresses of the nameservers for those domains, and says they are updated at least once a day. A zone file has no owner, no creation date, no expiry date and no status codes.
How ICANN zone file access works
Under their registry agreements with ICANN, generic TLD registries must provide bulk access to their zone files at least daily. ICANN's zone file access compliance page says internet users can access and download zone file data at no cost for certain purposes, after signing an agreement with the registry that operates the TLD. CZDS is where you sign that agreement electronically.
The obligation comes from the gTLD contract, and ICANN states that it "does not apply to any ccTLD." For a country-code extension, ask its own registry.
How to request CZDS access, step by step
- Create an ICANN account. Go to the CZDS portal and create a new account. The portal recommends Chrome for downloading.
- Complete your end-user profile. CZDS asks for your details before you can file a request. Fill it in accurately; it is part of what you submit.
- Choose the TLDs. You can request one TLD or several in the same request. The portal lists the participating generic extensions; new ones are added once they are delegated.
- Give a reason. The request form has a field for the purpose of your request. State it plainly, for example research on domain registrations and expirations in that extension.
- Accept the registry's terms. Each registry attaches its own terms, including what you may do with the data.
- Wait for each registry's decision. Every TLD is approved or denied separately by its own registry.
If a TLD you need is not listed in the portal, ICANN's advice is to contact that registry operator directly and ask for its zone file agreement.
Access term, waiting time and denials
Approved access is not permanent. ICANN's compliance page says approved users get access for at least three months; the exact term depends on the registry, and your dashboard shows the date access to each zone file expires. Note those dates: a script that quietly stops downloading is easy to miss.
There is no deadline for a decision. ICANN notes that the registry agreement "does not define a time period" for processing requests. ICANN also says a registry may deny or revoke access under certain circumstances. If you believe a registry is not meeting its zone file access obligations, ICANN offers a Zone File Access Complaint Form, linked from the same compliance page.
Zone file download: dashboard or API
Once a TLD is approved, its download button becomes active on your CZDS dashboard. You can also download from the request detail screen or through the CZDS API, which is the practical route for a daily scheduled fetch. Read ICANN's current API documentation rather than old code samples.
The limit that matters: you may download each zone file once per 24-hour period. That means one daily snapshot per TLD, not a live feed. Store each day's file with its date in the name, because the useful work is in comparing them.
Verisign zone file access for .com and .net
People often search for Verisign zone file access as if it were a separate program. Today Verisign's zone file page sends requesters to ICANN's CZDS for .com, .net, .name and its other generic TLDs. You request .com and .net in the portal like any other extension.
Verisign's page also lists what the files leave out, which is the key to reading them. The .com and .net zone files do not contain domain names in these states:
serverHoldandclientHold, where the registry or the registrar has taken the name out of the DNSredemptionPeriod, the 30 days after the grace period when only the previous owner can restore the namependingDelete, the final five days before deletion- names that have no nameservers at all
If those status codes are new to you, the guide to domain status codes explains each one from a buyer's point of view.
Using a daily diff to find names heading for a drop
Comparing today's file with yesterday's gives you names that appeared and names that disappeared. The second list is the interesting one, because a name that enters the redemption period leaves the zone that day.
Read that list carefully. A name can also disappear because:
- a registrar or the registry put it on hold, which can happen to a perfectly current registration
- the owner removed its nameservers, for instance while moving DNS providers
And some expiring names never disappear at all. Many registrars auction a domain during the grace period, and a domain sold that way goes to the buyer without ever dropping. The article on why not every expired domain goes to auction covers that path.
So a zone diff is a list of candidates, not a drop list. Confirm each candidate's status at the registry before you plan around it:
- Look the name up and read its status. A WHOIS/RDAP lookup shows the status codes in plain words.
- If the status is
redemptionPeriod, the gTLD clock is fixed: 30 days of redemption, then five days of pending delete. A .com or .net name is released in the daily drop on the sixth day after it enteredpendingDelete, at around 12:00 UTC. - Recheck the name when it should have reached pending delete. The previous owner can still restore it during redemption.
Say yesterday's .net file listed a name and today's does not, and the lookup shows the status changed to redemptionPeriod today. You now know the earliest day it could drop, and that it may never get there. A drop date calculator does the date arithmetic from the registry status for you.
For the wider picture of machine-readable sources, including marketplace feeds and filtered APIs, see the expired domain API guide.
What zone files cannot tell you
A diff tells you which names left the DNS today, not whether any of them is worth having. There is no backlink data, no archive history, no spam signal and no price in a zone file, and a .com diff holds far more names than anyone can check by hand.
What usually follows is a funnel: confirm the status, drop everything without links worth having, then read the archive history of what remains. If you would rather start from a list where that work is done, hunter.domains publishes a daily list of vetted expired domains built from marketplace and drop feeds, and the page on how the filtering and scoring works lists each check it runs. For free daily sources of raw names, see the free expired domains list guide.
Frequently asked questions
Is ICANN zone file access free?
Yes, for the purposes the registry agreements allow. ICANN says users can access and download zone file data at no cost for certain purposes, after agreeing to the registry's terms through CZDS. Read each registry's terms for what counts as a permitted use.
Can I get the .com zone file?
Yes. Verisign provides the .com, .net and .name zone files through ICANN's CZDS, so you request them in the same portal as any other generic extension. The files list active names and their nameservers, without names on hold, in redemption or in pending delete.
How often can I download a zone file from CZDS?
Once per 24-hour period for each TLD you are approved for. Registries refresh their files at least daily, so one download a day gives you a daily snapshot to compare.
Why was my CZDS request denied?
Each registry decides on its own TLD, and ICANN says a registry may deny or revoke access under certain circumstances. Check the registry's terms, file a clearer request, and if you think the registry is not meeting its obligations, use ICANN's Zone File Access Complaint Form.
