Name: Domain Lookup API: WHOIS, SSL, DNS and Email Checks
Brand: leadharbor
SKU: api-leadharbor-domain-toolkit
Availability: InStock
Author: API Market

Mohammed Samaan

# Domain Toolkit API

## Overview

The Domain Toolkit API runs six checks on a domain in one request and returns them together in one JSON report. It has 1 endpoint. You pass a domain name (or a full URL, which is reduced to its host) and get back up to six sections: `whois` with registration data over RDAP (registrar, created, updated and expiry dates, status flags, nameservers, DNSSEC), `ssl` with the certificate served on port 443 (trust, hostname match, expiry, issuer, key, protocol and chain), `email` with MX, SPF, DMARC, DKIM, MTA-STS, TLS-RPT and BIMI and an overall email grade, `records` with the A, AAAA, NS and CAA records, `redirects` with the redirect chain from `http://`, and `headers` with a security-headers score, grade and per-check advice. The `sections` parameter picks only the checks you need. Sections run in parallel and fail on their own: if one lookup times out, that section carries its own error and the rest still answer.

It is built for agencies, IT and security teams, SEO and email deliverability tools, and AI agents that need a quick health report on a domain without calling six different services. At the top of every response an `attention` list names what needs a look, such as an expired or untrusted certificate, a domain close to expiry, weak email authentication, a long redirect chain or a poor header grade. Each entry in `sections` has a `status` and a `data` object, dates are ISO 8601 timestamps in UTC, and counts such as `days_remaining`, `days_until_expiry` and `age_days` are whole days, so the report can go straight into a dashboard or an alert rule.

## Features

*   **1 endpoint, 6 checks**: WHOIS (RDAP), SSL certificate, email authentication, DNS records, redirects and security headers in one call.
*   **Simple inputs**: A `domain` such as `example.com`. Full URLs are accepted and reduced to the host. An optional `sections` list runs only some checks.
*   **Attention list**: A short list at the top of the response of findings that need action, so you do not have to read every section.
*   **Independent sections**: Sections run in parallel. A section that fails reports its own error while the others still return data.
*   **Certificate details**: Trust and hostname match, validity dates, days remaining, subject, issuer, alternative names, fingerprint, key type, TLS protocol, cipher and the certificate chain.
*   **Email authentication**: MX hosts and priorities, SPF record with includes and DNS lookup count, DMARC policy and reporting addresses, DKIM selectors found, MTA-STS, TLS-RPT and BIMI, with an email `grade` and `score`.
*   **Security headers grade**: Checks HSTS, Content-Security-Policy, framing protection, `X-Content-Type-Options`, Referrer-Policy, Permissions-Policy and cookie flags, with a 0 to 100 score, a letter grade and advice for each check.
*   **Data source**: Live lookups at request time over RDAP, DNS, a TLS connection to the domain and HTTP requests to its home page.
*   **Rate limit**: 10 requests per second on every plan.

## Use Cases

*   **Domain health monitoring**: Run the report on a schedule and alert on anything in the `attention` list, such as a certificate or registration that is about to expire.
*   **Email deliverability checks**: Use the `email` section to confirm SPF, DKIM and DMARC are in place before a client sends a campaign.
*   **Security reviews**: Grade a site's HTTP security headers and cookie flags and hand the per-check advice to the developers.
*   **Sales and agency audits**: Produce a quick technical report on a prospect's domain covering registration, SSL, email setup and redirects.
*   **Vendor and supplier checks**: Check how long a domain has been registered, who the registrar is and whether its certificate is trusted.
*   **AI agents and chat tools**: Give an agent one tool call that answers most questions about a domain.

## API Documentation

### Base URL

All requests go through the API.market gateway at this base URL:

```
https://prod.api.market/api/v1/leadharbor/domain-toolkit
```

### Authentication

Every request needs your API.market key in the `x-api-market-key` header:

```
x-api-market-key: YOUR_API_KEY
```

Replace `YOUR_API_KEY` with your actual API key.

### Endpoints

#### 1. Domain report

Returns the domain, the time the report was generated, the `attention` list and the requested `sections`. By default all six sections are run. A name that is not registered or does not resolve answers with that single finding instead of six empty sections.

**Method:** `GET`

**Endpoint:** `/v1/market/domain`

**Parameters:**

| Name | In | Description | Type | Required | Default | Max Value |
|---|---|---|---|---|---|---|
| `domain` | query | A public domain name such as `example.com`. Full URLs are accepted and reduced to the host. Private and internal addresses are refused. | string | Yes | - | - |
| `sections` | query | Comma-separated list of sections to run: `whois`, `ssl`, `email`, `records`, `redirects`, `headers`. An unknown section name returns `400`. | string | No | all six | - |

**Example Request:**

```bash
curl -X GET "https://prod.api.market/api/v1/leadharbor/domain-toolkit/v1/market/domain?domain=stripe.com" \
  -H "x-api-market-key: YOUR_API_KEY"
```

**Example Response (200 OK, abridged):**

```json
{
  "domain": "stripe.com",
  "generated_at": "2026-10-20T15:46:22.840Z",
  "attention": [],
  "sections": {
    "whois": {
      "status": "ok",
      "data": {
        "domain": "stripe.com",
        "queried": "stripe.com",
        "registered": true,
        "registrar": "SafeNames Ltd.",
        "created": "1995-09-12T04:00:00Z",
        "updated": "2025-10-01T01:39:51Z",
        "expires": "2027-09-11T04:00:00Z",
        "age_days": 11361,
        "days_until_expiry": 325,
        "expiry_warning": null,
        "status": [
          "client delete prohibited",
          "client transfer prohibited"
        ],
        "nameservers": [
          "ns-1087.awsdns-07.org",
          "ns-1882.awsdns-43.co.uk",
          "ns-423.awsdns-52.com",
          "ns-705.awsdns-24.net"
        ],
        "dnssec_signed": false,
        "rdap_server": "https://rdap.verisign.com/com/v1/"
      }
    },
    "ssl": {
      "status": "ok",
      "data": {
        "host": "stripe.com",
        "ip": "198.202.176.111",
        "port": 443,
        "trusted": true,
        "trust_error": null,
        "hostname_match": true,
        "expired": false,
        "valid_from": "2026-09-24T00:00:00.000Z",
        "valid_to": "2026-12-10T23:59:59.000Z",
        "days_remaining": 51,
        "expiry_warning": null,
        "subject": {
          "common_name": "stripe.com",
          "organization": "Stripe, LLC",
          "country": "US"
        },
        "issuer": {
          "common_name": "DigiCert G5 TLS ECC SHA384 2021 CA1",
          "organization": "DigiCert, Inc.",
          "country": "US"
        },
        "alt_names": [
          "stripe.com",
          "www.stripe.com"
        ],
        "serial_number": "01759F05C912F15ED36F0AB84D634B06",
        "fingerprint_sha256": "F1:9F:31:85:A7:09:28:41:7B:16:2C:11:84:55:D0:7F:E0:41:1A:C2:C3:B1:12:56:33:FE:21:96:27:C4:AD:98",
        "key_type": "EC",
        "key_bits": 256,
        "key_curve": "prime256v1",
        "protocol": "TLSv1.3",
        "cipher": "TLS_AES_256_GCM_SHA384",
        "chain": [
          {
            "subject": "stripe.com",
            "issuer": "DigiCert G5 TLS ECC SHA384 2021 CA1"
          },
          {
            "subject": "DigiCert G5 TLS ECC SHA384 2021 CA1",
            "issuer": "DigiCert TLS ECC P384 Root G5"
          }
        ]
      }
    },
    "email": {
      "status": "ok",
      "data": {
        "domain": "stripe.com",
        "grade": "good",
        "score": 100,
        "mx": [
          {
            "host": "aspmx.l.google.com",
            "priority": 10
          },
          {
            "host": "alt1.aspmx.l.google.com",
            "priority": 20
          }
        ],
        "null_mx": false,
        "spf": {
          "present": true,
          "record": "v=spf1 ip4:198.2.180.60/32 ip4:13.111.2.227/32 include:spf1.stripe.com include:greenhouse-outbound-mail.stripe.com include:_spf.qualtrics.com ~all",
          "multiple_records": false,
          "all": "softfail",
          "includes": [
            "spf1.stripe.com",
            "greenhouse-outbound-mail.stripe.com",
            "_spf.qualtrics.com"
          ],
          "dns_lookups": 3
        },
        "dmarc": {
          "present": true,
          "record": "v=DMARC1; p=reject; pct=100; fo=1; rua=mailto:dmarc-reports@stripe.com; ruf=mailto:dmarc-forensics@stripe.com;",
          "policy": "reject",
          "subdomain_policy": null,
          "percent": 100,
          "aggregate_reports": [
            "mailto:dmarc-reports@stripe.com"
          ],
          "forensic_reports": [
            "mailto:dmarc-forensics@stripe.com"
          ],
          "dkim_alignment": "r",
          "spf_alignment": "r"
        },
        "dkim": {
          "selectors_found": [
            "google",
            "s1",
            "s2",
            "mandrill"
          ],
          "checked": [
            "default",
            "google",
            "selector1",
            "selector2"
          ]
        },
        "mta_sts": {
          "present": false
        },
        "tls_rpt": {
          "present": false
        },
        "bimi": {
          "present": false
        },
        "issues": []
      }
    },
    "records": {
      "status": "ok",
      "data": {
        "domain": "stripe.com",
        "a": [
          "198.202.176.111",
          "198.137.150.111"
        ],
        "aaaa": [],
        "ns": [
          "ns-1087.awsdns-07.org",
          "ns-1882.awsdns-43.co.uk",
          "ns-423.awsdns-52.com",
          "ns-705.awsdns-24.net"
        ],
        "caa": [
          {
            "critical": false,
            "tag": "issue",
            "value": "digicert.com"
          },
          {
            "critical": false,
            "tag": "issue",
            "value": "visa.com"
          }
        ]
      }
    },
    "redirects": {
      "status": "ok",
      "data": {
        "start_url": "http://stripe.com/",
        "hop_count": 1,
        "final_url": "https://stripe.com/",
        "final_status": 200,
        "https_upgrade": true,
        "permanent": true,
        "hosts": [
          "stripe.com"
        ],
        "hops": [
          {
            "url": "http://stripe.com/",
            "status": 301,
            "location": "https://stripe.com/"
          },
          {
            "url": "https://stripe.com/",
            "status": 200
          }
        ],
        "issues": [],
        "complete": true
      }
    },
    "headers": {
      "status": "ok",
      "data": {
        "url": "https://stripe.com/",
        "status": 200,
        "https": true,
        "redirects": 0,
        "score": 75,
        "grade": "B",
        "checks": [
          {
            "id": "hsts",
            "weight": 20,
            "status": "pass",
            "value": "max-age=63072000; includeSubDomains; preload",
            "advice": "HSTS is set with a long max-age."
          },
          {
            "id": "referrer_policy",
            "weight": 10,
            "status": "warn",
            "value": "no-referrer-when-downgrade",
            "advice": "This policy leaks full URLs to other sites. Use strict-origin-when-cross-origin or stricter."
          }
        ],
        "cookies": [
          {
            "name": "cid",
            "secure": true,
            "http_only": false,
            "same_site": "lax"
          }
        ],
        "disclosed": {
          "server": "nginx",
          "x_powered_by": null
        }
      }
    }
  },
  "meta": {
    "user": null
  }
}
```

To run only some checks, pass `sections`. This request asks for the certificate and the security headers only:

```bash
curl -X GET "https://prod.api.market/api/v1/leadharbor/domain-toolkit/v1/market/domain?domain=github.com&sections=ssl%2Cheaders" \
  -H "x-api-market-key: YOUR_API_KEY"
```

**Example Response (200 OK, abridged):**

```json
{
  "domain": "github.com",
  "generated_at": "2026-10-20T15:46:20.219Z",
  "attention": [],
  "sections": {
    "ssl": {
      "status": "ok",
      "data": {
        "host": "github.com",
        "ip": "140.82.114.4",
        "port": 443,
        "trusted": true,
        "trust_error": null,
        "hostname_match": true,
        "expired": false,
        "valid_from": "2026-09-01T00:00:00.000Z",
        "valid_to": "2026-11-29T23:59:59.000Z",
        "days_remaining": 40,
        "expiry_warning": null,
        "subject": {
          "common_name": "github.com",
          "organization": null,
          "country": null
        },
        "issuer": {
          "common_name": "Sectigo Public Server Authentication CA DV E36",
          "organization": "Sectigo Limited",
          "country": "GB"
        },
        "alt_names": [
          "github.com",
          "www.github.com"
        ],
        "serial_number": "A59EBDB596751DB7F5C095079613953C",
        "fingerprint_sha256": "46:B6:01:EE:08:B4:18:CF:8A:3A:1E:BF:E6:70:BA:5C:E4:3B:B0:5A:91:7F:A8:B2:DD:08:7A:30:47:1C:FC:63",
        "key_type": "EC",
        "key_bits": 256,
        "key_curve": "prime256v1",
        "protocol": "TLSv1.3",
        "cipher": "TLS_AES_128_GCM_SHA256",
        "chain": [
          {
            "subject": "github.com",
            "issuer": "Sectigo Public Server Authentication CA DV E36"
          },
          {
            "subject": "Sectigo Public Server Authentication CA DV E36",
            "issuer": "Sectigo Public Server Authentication Root E46"
          }
        ]
      }
    },
    "headers": {
      "status": "ok",
      "data": {
        "url": "https://github.com/",
        "status": 200,
        "https": true,
        "redirects": 0,
        "score": 80,
        "grade": "B",
        "checks": [
          {
            "id": "hsts",
            "weight": 20,
            "status": "pass",
            "value": "max-age=31536000; includeSubdomains; preload",
            "advice": "HSTS is set with a long max-age."
          },
          {
            "id": "cookies",
            "weight": 15,
            "status": "fail",
            "value": "_octo",
            "advice": "Add Secure and HttpOnly to: _octo."
          }
        ],
        "cookies": [
          {
            "name": "_gh_sess",
            "secure": true,
            "http_only": true,
            "same_site": "lax"
          },
          {
            "name": "_octo",
            "secure": true,
            "http_only": false,
            "same_site": "lax"
          }
        ],
        "disclosed": {
          "server": "github.com",
          "x_powered_by": null
        }
      }
    }
  },
  "meta": {
    "user": null
  }
}
```

**Response fields:**

*   **`domain`** and **`generated_at`**: The domain checked and when the report was built.
*   **`attention`**: Findings that need a look. Empty when nothing stood out, as in both examples above.
*   **`sections`**: One key per section that ran, each with a `status` (`ok` when the check worked) and a `data` object.
*   **`sections.whois.data`**: Registrar, `created`, `updated` and `expires` dates, `age_days`, `days_until_expiry`, EPP status flags, nameservers, `dnssec_signed` and the RDAP server used.
*   **`sections.ssl.data`**: Host, IP and port, `trusted`, `trust_error`, `hostname_match`, `expired`, validity dates, `days_remaining`, subject, issuer, `alt_names`, serial number, SHA-256 fingerprint, key details, TLS protocol and cipher, and the certificate `chain`.
*   **`sections.email.data`**: Email `grade` and `score`, MX hosts with priority, `null_mx`, SPF, DMARC and DKIM details, MTA-STS, TLS-RPT and BIMI presence, and an `issues` list.
*   **`sections.records.data`**: A, AAAA, NS and CAA records.
*   **`sections.redirects.data`**: Start and final URL, `hop_count`, `final_status`, `https_upgrade`, `permanent`, the hosts visited, each hop with its status and location, and an `issues` list.
*   **`sections.headers.data`**: The URL tested, `score` (0 to 100), `grade`, each check with its weight, status (`pass`, `warn` or `fail`), value and advice, the cookies seen with their flags, and the `server` and `x_powered_by` values the site discloses.
*   **`meta`**: Metadata you can ignore. `user` is always `null`.

## Status Codes

| Code | Status | Description |
|---|---|---|
| 200 | OK | The report was built. A section that failed still returns `200` for the whole report, with that section's own error. |
| 400 | Bad Request | The `domain` parameter is missing or invalid, or `sections` names an unknown section. |
| 401 | Unauthorized | The `x-api-market-key` value is invalid or expired. |
| 403 | Forbidden | Your subscription does not include this endpoint. |
| 404 | Not Found | The path is wrong. Check that it is `/v1/market/domain`. |
| 429 | Too Many Requests | You went over 10 requests per second, or you have used all the calls in your plan. |
| 500 | Internal Server Error | Something failed while building the report. Retry after a short delay. |

## Rate Limits

The Free trial, Starter and PAYG plans each allow 10 requests per second. The Free trial includes 500 calls and the Starter plan 10,000 calls, with extra Starter calls billed at $0.001 each. PAYG has no subscription and costs $0.001 per call. Requests above the per-second limit, or after a plan's calls are used up, return `429 Too Many Requests`. Back off before retrying and honour the `Retry-After` header, which gives the number of seconds to wait. All checks are live lookups, so the response time depends on the domain being checked. In our tests the full six-section report for `stripe.com` took about 0.9 seconds and the `ssl,headers` report for `github.com` about 0.7 seconds.

## FAQ

**Can I run only some of the checks?**

Yes. Pass `sections` with a comma-separated list, for example `sections=ssl,headers`. The response then only contains those sections. Leave it out to run all six.

**What happens if one check fails?**

The sections run in parallel and fail independently. If one lookup times out or errors, that section carries its own error and the other sections still return their data, so you get a partial report instead of a failed request.

**What does the `attention` list contain?**

It names the findings that need action, such as an expired or untrusted certificate, a domain that is close to expiry, weak email authentication, a long redirect chain or a poor security-headers grade. An empty list means none of these were found.

**Can I pass a full URL instead of a domain?**

Yes. A URL such as `https://www.example.com/page` is reduced to its host before the checks run. Private and internal addresses are refused.

**What happens with a domain that is not registered?**

A name that is not registered or does not resolve answers with that single finding instead of six sections of empty or failed lookups.

**Is the security-headers grade a security audit?**

No. The grade covers HTTP header and cookie settings only. It is not a penetration test or a certification.

**How is DKIM checked when selectors are not public?**

DKIM keys can only be found by selector name, so the API tries a list of common selectors and reports the ones it found in `selectors_found` and the ones it tried in `checked`. A selector with an uncommon name may not be found.

## Contact Us

If you have any questions or need assistance, you can reach out to us through the embedded chat on the bottom right corner of the page or send an email to hello@magicapi.com.


Domain lookup API that returns WHOIS, SSL certificate, DNS records, SPF, DKIM and DMARC, redirects and a security headers grade in one call.

Domain Lookup API: WHOIS, SSL, DNS and Email Checks

Free trial