Name: DNS Checker API: DNS Lookup and Domain Audit
Brand: api-factory-1
SKU: api-api-factory-1-dns-domain-security-intelligence
Availability: InStock
Author: API Market

David Garcia

# DNS Checker API: DNS Lookup, DNSSEC and CAA Audit

## Overview

The DNS and Domain Security Intelligence API turns one domain name into a structured DNS report with a single call to GET /v1/domain. It looks up A, AAAA, CNAME, NS, SOA, MX, TXT and CAA records with their TTLs and a status for each record type, then adds analysis on top: the DNSSEC state, the CAA certificate issuers, a wildcard DNS probe, a CNAME target check and a guess at the DNS host from the nameservers. Everything is summed up in a reproducible 0 to 100 configuration health score with a grade and a list of the deductions, warnings and recommendations behind it.

It is built for SaaS teams onboarding customer domains, engineers checking a DNS migration, MSPs and IT teams reviewing client domains, security and infrastructure teams keeping a domain inventory, and monitoring tools that need a DNS checker API. The response is a JSON envelope with data and requestId. data holds domain, resolution, provider, records (one section per type with status, records and truncated), dnssec, caa, wildcard_dns, cname, ttl, health and meta with the check time and query counts.

## Features

*   **1 endpoint**: GET /v1/domain returns the full DNS audit for one domain per request.
*   **DNS lookup**: A, AAAA, CNAME, NS, SOA, MX, TXT and CAA records with name, type, TTL and value, plus a parsed SOA.
*   **DNSSEC and CAA**: Reports DNSSEC as secure, insecure or unknown with an explanation, and lists CAA issuers and issuewild tags.
*   **Wildcard and CNAME checks**: Probes a generated name for wildcard DNS and checks whether a CNAME target resolves.
*   **Health score**: A 0 to 100 score and grade with the exact deductions, warnings and recommendations that produced it.
*   **Per section status**: Each record type reports NOERROR, NXDOMAIN, SERVFAIL, REFUSED, TIMEOUT or UNKNOWN, and partial failures still return data.
*   **Rate limit**: Free trial 1 request per second, Pro 2, Ultra 3 and Mega 5 requests per second.

## Use Cases

*   **SaaS custom domain onboarding**: Check a customer's records and CNAME target before you mark their custom domain as connected.
*   **DNS migration checks**: Compare NS, SOA and record values before and after moving a domain to a new DNS host.
*   **MSP and IT reviews**: Run every client domain through one call and flag missing CAA, unknown DNSSEC or unusual TTLs.
*   **Domain inventory**: Record the DNS host, nameservers and MX provider for each domain your company owns.
*   **Infrastructure monitoring**: Schedule a DNS check API call and alert when the health score or record set changes.
*   **Security posture reporting**: Report CAA and DNSSEC coverage across a portfolio using the per domain findings.

## Pricing

| Plan | Price | What you get | Rate limit | Endpoints |
|---|---|---|---|---|
| Free | $0 | 7-day free trial with 100 API calls | 1 requests/second | 1 |
| Pro | $9.99/month | 1,000 calls/month, calls stop at the limit | 2 requests/second | 1 |
| Ultra | $29.99/month | 5,000 calls/month, calls stop at the limit | 3 requests/second | 1 |
| Mega | $69.99/month | 15,000 calls/month, calls stop at the limit | 5 requests/second | 1 |

## API Documentation

### Base URL

All requests go through the API.market gateway at this base URL:

```
https://prod.api.market/api/v1/api-factory-1/dns-domain-security-intelligence
```

### Authentication

Every request needs your API.market key in the `x-api-market-key` header:

```
x-api-market-key: YOUR_API_KEY
```

Replace `YOUR_API_KEY` with your actual API key.

### Endpoints

#### 1. Audit DNS infrastructure and selected configuration controls for one domain

Provide a bare domain, not a URL or IP address. DNS NXDOMAIN is an analyzed result (HTTP 200); individual upstream failures can yield partial data. DNSSEC 'secure' requires both a parent DS and authenticated child data from the resolver; 'insecure' requires authenticated absence of a parent DS; inconclusive states are 'unknown'. 'broken' is reserved and not asserted in v0.1.0. Wildcard detection uses one generated likely nonexistent name, stable per domain and UTC day, with A, AAAA and CNAME queries; false does not prove all wildcard behavior absent. CNAME target diagnostics check A and AAAA once and do not establish takeover risk. The score is a reproducible technical configuration indicator, not breach probability.

**Method:** `GET`

**Endpoint:** `/v1/domain`

**Parameters:**

| Name | In | Description | Type | Required | Default | Max Value |
|---|---|---|---|---|---|---|
| `domain` | query | Bare domain; case, surrounding whitespace, one trailing dot and IDN are normalized. Example: `example.com`. | string | Yes | - | - |

**Example Request:**

```bash
curl -X GET "https://prod.api.market/api/v1/api-factory-1/dns-domain-security-intelligence/v1/domain?domain=github.com" \
  -H "x-api-market-key: YOUR_API_KEY"
```

**Example Response (200 OK, abridged):**

```json
{
  "data": {
    "domain": "github.com",
    "resolution": {
      "status": "NOERROR",
      "partial": false
    },
    "provider": {
      "name": "unknown",
      "confidence": "unknown"
    },
    "records": {
      "a": {
        "status": "NOERROR",
        "records": [
          {
            "name": "github.com",
            "type": "A",
            "ttl": 44,
            "value": "140.82.114.3"
          }
        ],
        "truncated": false
      },
      "aaaa": {
        "status": "NOERROR",
        "records": [],
        "truncated": false
      },
      "cname": {
        "status": "NOERROR",
        "records": [],
        "truncated": false
      },
      "ns": {
        "status": "NOERROR",
        "records": [
          {
            "name": "github.com",
            "type": "NS",
            "ttl": 454,
            "value": "dns1.p08.nsone.net."
          }
        ],
        "truncated": false
      },
      "soa": {
        "status": "NOERROR",
        "records": [
          {
            "name": "github.com",
            "type": "SOA",
            "ttl": 3600,
            "value": "dns1.p08.nsone.net. hostmaster.nsone.net. 1656468023 43200 7..."
          }
        ],
        "truncated": false,
        "parsed": {
          "primary_nameserver": "dns1.p08.nsone.net",
          "responsible_mailbox": "hostmaster@nsone.net",
          "serial": 1656468023,
          "refresh": 43200,
          "retry": 7200,
          "expire": 1209600,
          "minimum_ttl": 3600
        }
      },
      "mx": {
        "status": "NOERROR",
        "records": [
          {
            "name": "github.com",
            "type": "MX",
            "ttl": 300,
            "value": "github-com.mail.protection.outlook.com.",
            "priority": 0
          }
        ],
        "truncated": false
      },
      "txt": {
        "status": "NOERROR",
        "records": [
          {
            "name": "github.com",
            "type": "TXT",
            "ttl": 300,
            "value": "\"00Dd0000000hHE0=1TBKg000000TN2r\""
          }
        ],
        "truncated": true
      },
      "caa": {
        "status": "NOERROR",
        "records": [
          {
            "name": "github.com",
            "type": "CAA",
            "ttl": 3600,
            "value": "0 issue \"digicert.com\""
          }
        ],
        "truncated": false
      }
    },
    "dnssec": {
      "status": "unknown",
      "ds_status": "NOERROR",
      "ds_records": [],
      "authenticated_data": false,
      "explanation": "The available resolver signals do not establish a validated ..."
    },
    "caa": {
      "status": "NOERROR",
      "configured": true,
      "records": [
        {
          "name": "github.com",
          "type": "CAA",
          "ttl": 3600,
          "value": "0 issue \"digicert.com\"",
          "tag": "issue",
          "issuer": "digicert.com"
        }
      ],
      "issuers": [
        "digicert.com"
      ]
    },
    "wildcard_dns": {
      "status": false,
      "query_statuses": [
        "NOERROR"
      ]
    },
    "cname": {
      "target": null,
      "resolution_status": "not_applicable",
      "chain_depth_evaluated": 0
    },
    "ttl": {
      "minimum": 44,
      "maximum": 3600,
      "summary": "26 bounded records; observed TTL range 44\u20133600 seconds"
    },
    "health": {
      "score": 98,
      "grade": "A",
      "deductions": [
        {
          "code": "UNUSUAL_TTL",
          "points": 2
        }
      ],
      "meaning": "DNS technical configuration health; not breach probability",
      "warnings": [
        {
          "code": "UNUSUAL_TTL",
          "severity": "info",
          "field": "ttl",
          "message": "A TTL is below 60 seconds or above 7 days; confirm it fits t..."
        }
      ],
      "recommendations": [
        {
          "code": "UNUSUAL_TTL",
          "field": "ttl",
          "message": "Review TTLs against operational change needs."
        }
      ]
    }
  },
  "requestId": "c49522ae-54b2-4c72-87ca-8b7ce1ab96d7"
}
```

## Status Codes

| Code | Status | Description |
|---|---|---|
| 200 | OK | The request succeeded and the data is in the response body. |
| 400 | Bad Request | A required parameter is missing or invalid, or the `x-api-market-key` header is missing. |
| 401 | Unauthorized | The `x-api-market-key` value is invalid or expired. |
| 403 | Forbidden | Your subscription does not include this endpoint. Check which endpoints your plan includes. |
| 404 | Not Found | The requested item or path was not found. |
| 429 | Too Many Requests | You went over your plan's rate limit (1 to 2 to 3 to 5 requests/second depending on plan) or used up your plan's calls. |
| 500 | Internal Server Error | Something failed while processing the request. Retry after a short delay. |
| 503 | Service Unavailable | The service is temporarily unavailable. Retry later. |

## Rate Limits

The free trial allows 1 request per second and 100 calls. Pro allows 2 requests per second and 1,000 calls a month, Ultra 3 requests per second and 5,000 calls, and Mega 5 requests per second and 15,000 calls; all plans have hard limits, so calls over the monthly quota are blocked until the next cycle or an upgrade. If you exceed the per second limit you get HTTP 429, so back off, wait for the time given in the Retry-After header when it is present, and retry.

## FAQ

**Is there a free trial?**

Yes. The Free plan is a 7-day free trial with 100 API calls at up to 1 request per second.

**How much do the paid plans cost?**

Pro is $9.99 a month for 1,000 calls, Ultra is $29.99 a month for 5,000 calls and Mega is $69.99 a month for 15,000 calls. All plans include the same endpoint and have hard monthly limits with no overage billing.

**How do I call the API?**

Send GET /v1/domain?domain=example.com with your API key in the x-api-market-key header. The response is JSON with a data object and a requestId.

**What should I pass as the domain?**

A bare domain such as example.com, not a URL with https:// or a path, and not an IP address. Case, surrounding spaces, one trailing dot and internationalized domain names are normalized for you; invalid input returns an INVALID_DOMAIN error.

**What does the health score mean?**

It is a deterministic score for DNS technical configuration, not a breach or attack risk rating. data.health.deductions lists each code and the points it cost, for example missing DNSSEC costs 5 points and missing CAA costs 3.

**Why does DNSSEC show unknown?**

secure needs a parent DS record and authenticated data from the resolver, and insecure needs authenticated proof that no DS exists. When the resolver signals do not establish either, the status is unknown and the explanation field says why.

**What happens if the domain does not exist or some lookups fail?**

An NXDOMAIN result is still returned with HTTP 200 and analyzed. If individual lookups fail, the response is marked partial and each record section carries its own status, and long record sets are cut off with truncated set to true.

**Does it check SPF, DKIM or DMARC?**

No. MX and TXT records are returned as raw DNS records only. Lookups run through Cloudflare's public resolver at request time; this is an independent API, not affiliated with or endorsed by Cloudflare.

## Contact Us

If you have any questions or need assistance, you can reach out to us through the embedded chat on the bottom right corner of the page or send an email to hello@magicapi.com.


DNS lookup API for one domain per call: A, AAAA, MX, NS, TXT and CAA records, DNSSEC, wildcard check and a 0-100 health score. Start with a free trial.

DNS Checker API: DNS Lookup and Domain Audit

Free

api-factory

Ultra

Mega

DNS checker and DNS lookup API that audits a domain's A, AAAA, NS, MX, TXT and CAA records, DNSSEC, wildcard DNS and DNS host with a 0-100 health score.