DomainTools provides threat intelligence and domain research platforms used by security teams, fraud investigators, and IT professionals to investigate domain ownership, DNS infrastructure, and potential security threats. The platform combines historical WHOIS data, DNS records, and risk scoring to help organizations identify malicious domains, track threat actors, and protect their digital assets.
DomainTools pricing is structured around product tiers and API access levels, with costs varying based on query volume, data depth, and the number of users. Published list pricing exists for some tiers, but actual contract terms—including discounts, volume commitments, and bundled services—are typically negotiated based on organizational size, use case, and contract length.
Evaluating DomainTools or planning a purchase?
Vendr's pricing analysis agent uses anonymized contract data to show what similar companies typically pay and where negotiation leverage exists—whether you're estimating budget, comparing options, or reviewing a quote. Explore DomainTools pricing with Vendr.
This guide combines DomainTools' published pricing with Vendr's dataset and analysis to break down DomainTools pricing in 2026, including:
Whether you're evaluating DomainTools for the first time or preparing for renewal, this guide is designed to help you budget accurately and negotiate with clearer market context.
DomainTools pricing is based on several factors: the product tier selected (Iris, PhishEye, Farsight DNSDB, or API access), the number of users or seats, query volume limits, and contract term length. The platform offers both subscription-based access for investigative tools and usage-based pricing for API integrations.
Core pricing components:
List pricing for entry-level tiers starts around $99–$199 per user per month for basic research access, while enterprise Iris deployments with multiple users and API access commonly range from $25,000 to over $150,000 annually depending on scope. Volume-based discounts and multi-year terms are common negotiation points.
Based on anonymized DomainTools transactions in Vendr's platform, buyers often achieve below-list pricing through volume commitments, annual prepayment, and competitive positioning. See what similar companies pay for DomainTools.
DomainTools structures its offerings around distinct products rather than a single tiered platform. The primary products—Iris, PhishEye, Farsight DNSDB, and API access—each serve different use cases and carry separate pricing models.
DomainTools Iris is the flagship threat intelligence and investigation platform, providing domain research, risk scoring, and infrastructure mapping for security analysts and fraud investigators.
Pricing Structure:
Iris is priced per named user on an annual subscription basis. List pricing typically starts around $3,000–$5,000 per user annually for small teams, with volume discounts applied as seat count increases. Enterprise deployments with 10+ users and API access commonly fall in the $40,000–$120,000 annual range depending on query limits and data access levels.
Observed Outcomes:
Vendr data shows buyers often achieve below-list pricing through annual prepayment and multi-year commitments. Volume-based discounts become more significant at 5+ seats, and competitive evaluations (especially against Recorded Future or PassiveTotal) frequently create additional negotiation leverage.
Benchmarking context:
Compare your Iris deployment to similar companies using Vendr's percentile-based pricing benchmarks across different team sizes and query volumes.
PhishEye is DomainTools' brand monitoring and domain impersonation detection service, designed to identify lookalike domains and phishing threats targeting an organization's brand.
Pricing Structure:
PhishEye is typically priced as an annual subscription based on the number of monitored domains and alert volume. List pricing commonly starts around $10,000–$15,000 annually for small deployments monitoring a handful of core domains, scaling upward based on the number of monitored terms, alert frequency, and integration requirements.
Observed Outcomes:
Based on Vendr transaction data, discounting is common for multi-year agreements and when PhishEye is bundled with Iris or API products. Buyers evaluating competitive brand monitoring tools often secure better pricing through competitive positioning.
Benchmarking context:
See PhishEye pricing for similar monitoring scopes using Vendr's anonymized contract data.
Farsight DNSDB provides passive DNS data for threat hunting, incident response, and infrastructure research. It is often purchased alongside Iris or as a standalone API product.
Pricing Structure:
DNSDB is priced based on query volume and data retention depth. Annual subscriptions typically start around $8,000–$12,000 for moderate query limits, with enterprise deployments exceeding $30,000 annually for high-volume API access and extended historical data.
Observed Outcomes:
Vendr data shows multi-year commitments and bundled purchases with other DomainTools products commonly yield discounts. Volume-based pricing tiers create opportunities for negotiation as query needs scale.
Benchmarking context:
Get percentile benchmarks for DNSDB pricing based on your query volume and retention requirements.
DomainTools offers several API products (WHOIS API, Hosting History API, Reverse IP API, etc.) for programmatic access to domain intelligence data.
Pricing Structure:
API products are priced based on monthly query limits and the specific APIs included. Entry-level API packages start around $500–$1,000 per month for limited query volumes, while enterprise API bundles with high query limits and multiple endpoints commonly range from $15,000 to $60,000+ annually.
Observed Outcomes:
Based on Vendr's dataset, buyers often negotiate volume-based pricing tiers and annual prepayment discounts. Bundling API access with Iris or other investigative products frequently unlocks better per-query rates.
Benchmarking context:
Analyze API pricing for your query volume using Vendr's per-query rate benchmarks and comparable deal outcomes.
Understanding the key cost drivers helps buyers forecast total spend and identify negotiation opportunities.
Primary cost drivers:
Cost optimization strategies:
Right-sizing user seats and query limits to actual usage patterns prevents overpaying for unused capacity. Buyers who commit to annual prepayment and multi-year terms typically achieve better per-user and per-query rates. Bundling multiple DomainTools products in a single contract often creates leverage for deeper discounts.
Based on Vendr transaction data, the most significant cost variations occur around user count thresholds and query volume tiers. Model your total cost across deployment scenarios using Vendr's pricing tools.
Beyond base subscription pricing, several additional costs can impact total DomainTools spend.
Common additional costs:
Planning for total cost:
Buyers should clarify overage policies, support tier inclusions, and professional services scope during initial negotiations. Negotiating overage rate caps, bundled training, and flexible user expansion terms upfront can prevent unexpected costs during the contract term.
Based on anonymized DomainTools contracts in Vendr's dataset, professional services and overage fees commonly add to the base subscription cost for growing teams. Model total cost of ownership including hidden fees using Vendr's analysis tools.
Actual DomainTools pricing varies based on product mix, user count, query volume, and negotiation effectiveness. While list pricing provides a starting point, observed contract outcomes often fall meaningfully below published rates.
Typical pricing ranges by deployment size:
Based on anonymized DomainTools transactions in Vendr's platform:
Factors influencing observed pricing:
Buyers who commit to multi-year terms, annual prepayment, and volume-based user commitments typically achieve below-list pricing. Competitive evaluations against Recorded Future, PassiveTotal, or open-source alternatives create additional negotiation leverage. Bundling multiple DomainTools products in a single contract often unlocks package discounts not available when purchasing products separately.
Benchmarking context:
Get percentile-based pricing for your specific scope using Vendr's DomainTools benchmarks to assess how quotes align with recent market outcomes.
DomainTools pricing is negotiable, and buyers who prepare strategically often achieve meaningfully better outcomes than those who accept initial quotes. The following strategies are based on anonymized DomainTools deals in Vendr's dataset and reflect tactics that have created leverage in recent negotiations.
DomainTools sales teams have flexibility to discount, especially when buyers engage 60–90 days before a decision deadline. Establishing a clear budget range early in the conversation anchors negotiations and signals that pricing must fit within defined parameters. Buyers who frame budget constraints around internal approval thresholds (e.g., "We have $40,000 approved for threat intelligence this year") create natural negotiation boundaries.
Vendr data shows that buyers who engage early and communicate budget constraints clearly often achieve better pricing than those who negotiate under time pressure near contract deadlines.
DomainTools pricing is heavily influenced by user count and query volume commitments. Buyers should analyze actual usage patterns from trials or existing deployments to avoid over-committing to seats or query limits that won't be fully utilized. Negotiating flexible user expansion terms (e.g., the ability to add users mid-contract at the same discounted rate) prevents paying list pricing for growth.
Benchmarking context:
Model total cost across user and query scenarios using Vendr's usage analysis tools to identify the most cost-effective tier.
DomainTools typically offers discounts for 2–3 year commitments compared to annual contracts. However, buyers should balance discount depth against flexibility needs, especially if organizational requirements or threat intelligence strategies may evolve. Negotiating annual price caps or fixed escalation rates (e.g., 3–5% annual increases) within multi-year agreements protects against aggressive renewal pricing.
Based on Vendr transaction data, buyers who negotiate multi-year terms with clear price protection clauses often achieve better long-term value than those who accept standard multi-year discounts without escalation caps.
Purchasing Iris, PhishEye, DNSDB, and API access as a bundled package typically unlocks deeper discounts than buying products separately. Buyers evaluating multiple DomainTools products should request package pricing and compare the bundled rate against the sum of individual product quotes. Bundling also creates leverage to negotiate included professional services, training, or premium support.
Vendr data shows that bundled DomainTools contracts commonly achieve better per-product pricing than standalone purchases.
DomainTools competes with Recorded Future, PassiveTotal (now part of Microsoft), Shodan, and open-source threat intelligence tools. Buyers who conduct parallel evaluations and share competitive pricing (without disclosing specific vendor names or confidential terms) create negotiation leverage. Even if DomainTools is the preferred solution, demonstrating that alternatives are being seriously considered often unlocks additional discounting.
Competitive context:
Compare DomainTools to alternatives using Vendr's competitive pricing analysis for similar threat intelligence requirements.
Overage fees for exceeding query limits can significantly increase total cost. Buyers should negotiate overage rate caps (e.g., overages charged at no more than 1.2× base per-query rate) and flexible upgrade paths that allow moving to higher-volume tiers mid-contract without penalties. Clarifying how user additions, query limit increases, and product expansions are priced prevents unexpected costs during the contract term.
Based on Vendr data, buyers who negotiate clear overage policies and flexible expansion terms upfront often avoid unplanned mid-contract costs.
DomainTools follows a calendar fiscal year, with quarter-end and year-end periods (March 31, June 30, September 30, December 31) creating urgency for sales teams to close deals. Buyers who time final negotiations to align with these periods—especially Q4 (October–December)—often unlock additional concessions as sales teams work to meet quotas.
Vendr transaction data shows that deals closed in the final two weeks of a quarter commonly achieve better pricing than those closed mid-quarter, all else being equal.
These insights are based on anonymized DomainTools deals in Vendr's dataset across a wide range of company sizes and contract structures. Buyers can explore these insights directly using Vendr's free pricing and negotiation tools:
DomainTools operates in the threat intelligence and domain research market alongside several alternatives. The following comparisons focus on pricing structures and cost considerations to help buyers evaluate total cost of ownership across options.
| Pricing component | DomainTools | Recorded Future |
|---|---|---|
| Entry-level annual cost | $12,000–$25,000 (small Iris deployment) | $25,000–$40,000 (basic threat intelligence platform) |
| Per-user pricing model | Yes, Iris priced per named user | Yes, platform access priced per analyst seat |
| API/query-based pricing | Yes, separate API products with volume tiers | Yes, API access included in higher tiers or sold separately |
| Multi-year discount range | Common for committed terms | Common for committed terms |
| Estimated total (10 users, enterprise tier) | $60,000–$120,000 annually | $100,000–$200,000+ annually |
Benchmarking context:
Compare percentile-based benchmarks for both platforms using Vendr's comparative pricing analysis across similar deployment sizes.
| Pricing component | DomainTools | PassiveTotal (Microsoft) |
|---|---|---|
| Entry-level annual cost | $12,000 –$25,000 (Iris) | $15,000–$30,000 (PassiveTotal standalone) |
| Per-user pricing model | Yes, per named user | Yes, per analyst seat |
| API/query-based pricing | Yes, separate API products | Yes, API access included or sold separately |
| Microsoft ecosystem integration | Limited | Native integration with Microsoft security stack |
| Estimated total (10 users) | $60,000–$100,000 annually | $50,000–$90,000 annually (standalone); often bundled with Microsoft E5 |
Benchmarking context:
Assess total cost of ownership for both platforms using Vendr's PassiveTotal and DomainTools benchmarks, especially when evaluating bundled Microsoft pricing.
| Pricing component | DomainTools | Shodan |
|---|---|---|
| Entry-level annual cost | $12,000–$25,000 (Iris) | $59–$899/month ($708–$10,788 annually) for API access |
| Per-user pricing model | Yes, per named user | No, API-based pricing by query volume |
| Investigative platform | Yes, Iris provides GUI-based investigation tools | Limited GUI; primarily API and CLI-driven |
| Domain/DNS focus | Core focus on domain intelligence and WHOIS | Broader internet-wide device and service scanning |
| Estimated total (enterprise use) | $60,000–$120,000 annually | $10,000–$25,000 annually (high-volume API access) |
Benchmarking context:
Understand cost trade-offs between DomainTools and Shodan to determine whether one tool or a combination best fits your threat intelligence strategy.
Based on anonymized DomainTools transactions in Vendr's platform over the past 12 months:
Vendr's dataset shows teams with multi-year commitments and volume-based user counts often achieved lower total contract value compared to list pricing through strategic negotiation.
Negotiation guidance:
Access DomainTools negotiation playbooks with supplier-specific tactics and timing strategies to maximize discount depth.
Based on DomainTools transactions in Vendr's database:
For a small team (1–5 users) purchasing DomainTools Iris on an annual contract:
Adding API access or PhishEye typically increases total cost depending on query volume and monitoring scope.
Benchmarking context:
See percentile-based pricing for small teams using Vendr's benchmarks for 1–5 user deployments.
Renewal pricing depends on whether you're expanding scope, maintaining the same deployment, or reducing usage.
Based on Vendr transaction data for DomainTools renewals:
Vendr data shows that buyers who engage 60–90 days before renewal and demonstrate competitive evaluation often achieve better pricing than those who negotiate under time pressure in the final weeks.
Negotiation guidance:
Get renewal playbooks for DomainTools with supplier-specific strategies including timing, leverage points, and framing tactics.
Yes, several costs beyond base subscription pricing can impact total spend:
Based on anonymized DomainTools contracts in Vendr's platform:
Vendr's dataset shows that overage fees and professional services commonly add to base subscription cost for growing teams that don't negotiate clear expansion terms upfront.
Negotiation guidance:
Model total cost of ownership including hidden fees using Vendr's cost analysis tools and negotiate overage rate caps during initial contract negotiations.
Based on Vendr transaction data comparing DomainTools and Recorded Future deals:
Vendr data shows that buyers evaluating both platforms often use competitive pricing to negotiate additional discounts by demonstrating serious consideration of the alternative.
Competitive benchmarks:
Get side-by-side pricing comparisons for DomainTools and Recorded Future based on your specific requirements using Vendr's competitive analysis.
DomainTools Iris is a GUI-based investigative platform designed for security analysts to research domains, map infrastructure, and assess threat risk through an interactive interface. It is priced per named user on an annual subscription basis.
DomainTools API products provide programmatic access to domain intelligence data (WHOIS, DNS, hosting history, etc.) for integration into SIEM platforms, security orchestration tools, or custom applications. API products are priced based on monthly query volume and the specific APIs included.
Many organizations purchase both: Iris for analyst-driven investigations and API access for automated threat detection workflows.
A standard Iris subscription includes access to the investigative platform, domain risk scoring, WHOIS and DNS lookups, infrastructure mapping, and basic threat intelligence feeds. The number of monthly queries and depth of historical data access vary by pricing tier. Premium data feeds, advanced analytics, and high-volume API access typically require add-ons or higher-tier subscriptions.
Yes, DomainTools allows mid-contract expansions, but pricing terms vary. User additions are often charged at list pricing unless flexible expansion terms were negotiated upfront. Query limit increases may require upgrading to a higher-volume tier, sometimes with pro-rated charges. Buyers should negotiate clear expansion pricing and upgrade paths during initial contract negotiations to avoid paying premium rates for growth.
DomainTools typically offers limited free trials or proof-of-concept access for qualified buyers. Trial scope, duration, and data access levels are negotiated case-by-case. Buyers should request trial access early in the evaluation process to validate use cases and assess actual query volume needs before committing to a subscription.
Based on analysis of anonymized DomainTools deals in Vendr's dataset, pricing varies significantly based on product mix, user count, query volume, and negotiation approach.
Key takeaways:
Regardless of platform choice, the most important step is clearly defining requirements, understanding total cost drivers, and benchmarking pricing against comparable deals before committing.
Explore percentile-based benchmarks and negotiation patterns using Vendr's pricing and negotiation tools to assess how DomainTools quotes compare to recent market outcomes for similar scope.
This guide is updated regularly to reflect recent DomainTools pricing and negotiation trends. Consider revisiting it ahead of any new purchase or renewal to account for changing market conditions. Last updated: February 2026.