Name: Domain Security API: WHOIS, SSL Certificate, DNS, DMARC
Brand: martindata
SKU: api-martindata-domainsecuritysuite-api
Availability: InStock
Author: API Market

Martin Petrov

# Domain Security API

## Overview

The Domain Security API combines two domain checks in one subscription. `/m/domain-whois-dns-lookup` returns RDAP registration data for each domain, with the registrar, created, updated and expiry dates, days to expiry, domain age, status codes, nameservers and DNSSEC, plus optional DNS records (A, AAAA, MX, NS, TXT, CAA, SPF and DMARC), the TLS certificate with issuer, validity dates, days left, TLS version and alternative names, and the HTTP redirect chain. `/m/email-dns-dmarc-spf-check` audits MX, SPF, DMARC, DKIM, MTA-STS, TLS-RPT and BIMI with an A to F grade and a fix for each issue.

It is built for developers of security scanners, domain portfolio tools, brand protection services, MSP dashboards and due diligence workflows. In our tests apify.com, github.com and wikipedia.org came back with registrar, expiry dates, certificate issuer and days left, and the redirect chain from http to https, in about 1.5 seconds, while a domain that is not registered returned `registered: false`.

## Features

*   **2 endpoints**: WHOIS, DNS, SSL and redirects, plus an email DNS audit.
*   **RDAP registration data**: registrar, created and expiry dates, days to expiry, age, status and nameservers.
*   **SSL certificate**: issuer, validity dates, days left, TLS version and alternative names.
*   **DNS and redirects**: A, AAAA, MX, NS, TXT and CAA records and the HTTP redirect chain.
*   **Expiry filter**: `expiringWithinDays` keeps only domains due for renewal.
*   **Billed per result**: one unit per result returned, shown in the `billed` field. Errors and empty results are free.

## Use Cases

*   **Security scanners**: check SSL, DNS and email security of a domain in two calls.
*   **Domain portfolios**: find domains and certificates that expire soon.
*   **Brand protection**: check who registered a lookalike domain and when.
*   **MSP dashboards**: monitor client domains for expiring certificates.
*   **Due diligence**: see the age and registrar of a company domain.

## API Documentation

### Base URL

All requests use the following base URL.

```
https://prod.api.market/api/v1/martindata/domainsecuritysuite-api
```

### Authentication

All requests are authenticated with the `x-api-market-key` header.

```
x-api-market-key: YOUR_API_KEY
```

Replace `YOUR_API_KEY` with your actual API key.

### Endpoints

#### 1. Look up WHOIS, DNS and SSL

Returns one item per domain with RDAP data and, when turned on, DNS records, the TLS certificate and the redirect chain.

**Method:** `POST`

**Endpoint:** `/m/domain-whois-dns-lookup`

**Parameters:**

| Name | In | Description | Type | Required | Default | Max Value |
|---|---|---|---|---|---|---|
| `domains` | body | Domain names, for example `github.com`. URLs are accepted and the host is used. | array of strings | No | - | 100 |
| `includeDns` | body | Add A, AAAA, MX, NS, TXT and CAA records plus parsed SPF and DMARC | boolean | No | - | - |
| `includeSsl` | body | Connect to port 443 and add the TLS certificate details | boolean | No | - | - |
| `includeRedirects` | body | Follow HTTP redirects from `http://domain` and report the chain and final URL | boolean | No | - | - |
| `expiringWithinDays` | body | Keep only domains whose registration expires within this many days. `0` keeps all. | integer | No | `0` | - |
| `trackIpChanges` | body | Also flag changing A and AAAA addresses in change detection | boolean | No | `false` | - |

**Example Request:**

```bash
curl -X POST 'https://prod.api.market/api/v1/martindata/domainsecuritysuite-api/m/domain-whois-dns-lookup' \
  -H 'x-api-market-key: YOUR_API_KEY' \
  -H 'Content-Type: application/json' \
  -d '{"domains": ["apify.com", "github.com", "wikipedia.org"], "includeDns": true, "includeSsl": true, "includeRedirects": true, "expiringWithinDays": 0, "trackIpChanges": false}'
```

**Example Response (200 OK):**

```json
{
  "billed": 3,
  "count": 3,
  "items": [
    {
      "availabilitySource": "rdap",
      "available": false,
      "createdDate": "2007-10-09T18:20:50Z",
      "daysToExpiry": 697,
      "dns": {
        "A": [
          "140.82.121.4"
        ],
        "AAAA": [],
        "CAA": [
          "0 issue \"digicert.com\"",
          "0 issue \"globalsign.com\"",
          "0 issue \"letsencrypt.org\""
        ],
        "DMARC": [
          "v=DMARC1; p=quarantine; sp=reject; pct=100; rua=mailto:dmarc@github.com; ruf=mailto:dmarc@github.com; fo=1"
        ],
        "MX": [
          "0 github-com.mail.protection.outlook.com."
        ],
        "NS": [
          "dns1.p08.nsone.net.",
          "dns2.p08.nsone.net.",
          "dns3.p08.nsone.net."
        ],
        "SPF": [
          "v=spf1 ip4:192.30.252.0/22 include:spf.protection.outlook.com include:_netblocks.google.com include:_netblocks2.google.com include:mail.zendesk.com include:_spf.salesforce.com..."
        ],
        "TXT": [
          "00Dd0000000hHE0=1TBKg000000TN2r",
          "MS=6BF03E6AF5CB689E315FB6199603BABF2C88D805",
          "MS=ms44452932"
        ]
      },
      "dnssec": false,
      "domain": "github.com",
      "domainAgeDays": 6973,
      "error": null,
      "expiryDate": "2028-10-09T18:20:50Z",
      "nameservers": [
        "dns1.p08.nsone.net",
        "dns2.p08.nsone.net",
        "dns3.p08.nsone.net"
      ],
      "rdapSource": "https://rdap.verisign.com/com/v1/domain/github.com",
      "redirect": {
        "chain": [
          {
            "status": 301,
            "url": "http://github.com/"
          },
          {
            "status": 200,
            "url": "https://github.com/"
          }
        ],
        "finalStatus": 200,
        "finalUrl": "https://github.com/"
      },
      "registered": true,
      "registrar": "MarkMonitor Inc.",
      "registrarIanaId": "292",
      "scrapedAt": "2026-11-12T15:37:22Z",
      "ssl": {
        "daysLeft": 76,
        "issuer": "Sectigo Limited",
        "notAfter": "2027-01-27T23:59:59Z",
        "notBefore": "2026-10-30T00:00:00Z",
        "san": [
          "github.com",
          "www.github.com"
        ],
        "tlsVersion": "TLSv1.3",
        "valid": true
      },
      "status": [
        "client delete prohibited",
        "client transfer prohibited",
        "client update prohibited"
      ],
      "updatedDate": "2026-09-07T09:22:52Z"
    }
  ]
}
```

The `items` list above is shortened to one of three domains.

#### 2. Check email DNS records

Returns one item per domain with MX, SPF, DMARC, DKIM, MTA-STS, TLS-RPT and BIMI results, a grade and the issues found.

**Method:** `POST`

**Endpoint:** `/m/email-dns-dmarc-spf-check`

**Parameters:**

| Name | In | Description | Type | Required | Default | Max Value |
|---|---|---|---|---|---|---|
| `domains` | body | Bare domain names such as `example.com`, without `https://` or a mailbox. A malformed entry returns a row with status `invalid_format`. | array of strings | No | - | 50 |
| `domain` | body | Shortcut for a single domain, the same as a one entry `domains` list | string | No | - | - |
| `dkimSelectors` | body | Your own DKIM selector names, the part before `._domainkey`, checked next to the common ones | array of strings | No | - | 20 |

**Example Request:**

```bash
curl -X POST 'https://prod.api.market/api/v1/martindata/domainsecuritysuite-api/m/email-dns-dmarc-spf-check' \
  -H 'x-api-market-key: YOUR_API_KEY' \
  -H 'Content-Type: application/json' \
  -d '{"domains": ["github.com"]}'
```

**Example Response (200 OK):**

```json
{
  "billed": 1,
  "count": 1,
  "items": [
    {
      "bimi": {
        "found": false,
        "logoUrl": null,
        "record": null,
        "vmcUrl": null
      },
      "checkedAt": "2026-11-12T15:37:17Z",
      "dkim": {
        "found": true,
        "keys": [
          {
            "keyBits": 2048,
            "keyFingerprint": "1fcee30be96781c5",
            "keyType": "rsa",
            "revoked": false,
            "selector": "google",
            "testMode": false
          },
          {
            "keyBits": 1024,
            "keyFingerprint": "74695ba48e84f277",
            "keyType": "rsa",
            "revoked": false,
            "selector": "selector1",
            "testMode": false
          },
          {
            "keyBits": 1024,
            "keyFingerprint": "cf73ac5d54e4f91a",
            "keyType": "rsa",
            "revoked": false,
            "selector": "k1",
            "testMode": false
          }
        ],
        "selectorsChecked": [
          "google",
          "selector1",
          "selector2"
        ]
      },
      "dmarc": {
        "adkim": "r",
        "aspf": "r",
        "found": true,
        "pct": 100,
        "policy": "quarantine",
        "record": "v=DMARC1; p=quarantine; sp=reject; pct=100; rua=mailto:dmarc@github.com; ruf=mailto:dmarc@github.com; fo=1",
        "rua": [
          "mailto:dmarc@github.com"
        ],
        "ruf": [
          "mailto:dmarc@github.com"
        ],
        "subdomainPolicy": "reject"
      },
      "domain": "github.com",
      "grade": "B",
      "issueCount": 3,
      "issues": [
        {
          "area": "spf",
          "fix": "Remove includes of services you no longer use before adding new ones.",
          "issue": "SPF uses 10 of 10 allowed DNS lookups, so one more include breaks it.",
          "severity": "low"
        },
        {
          "area": "dkim",
          "fix": "Rotate to a 2048-bit RSA key (check that your DNS host accepts long TXT records).",
          "issue": "DKIM key for selector selector1 is 1024 bits; 2048 is the current recommendation.",
          "severity": "low"
        },
        {
          "area": "dkim",
          "fix": "Rotate to a 2048-bit RSA key (check that your DNS host accepts long TXT records).",
          "issue": "DKIM key for selector k1 is 1024 bits; 2048 is the current recommendation.",
          "severity": "low"
        }
      ],
      "mtaSts": {
        "error": null,
        "id": null,
        "maxAge": null,
        "mode": null,
        "mx": [],
        "policyFetched": false,
        "txtFound": false
      },
      "mx": {
        "found": true,
        "nullMx": false,
        "records": [
          {
            "host": "github-com.mail.protection.outlook.com",
            "isCname": false,
            "priority": 0,
            "resolves": true
          }
        ]
      },
      "score": 88,
      "spf": {
        "dnsLookups": 10,
        "errors": [],
        "found": true,
        "includes": [
          "spf.protection.outlook.com",
          "_netblocks.google.com",
          "_netblocks2.google.com"
        ],
        "lookupLimit": 10,
        "lookupLimitExceeded": false,
        "mechanisms": [
          {
            "mechanism": "ip4",
            "qualifier": "pass",
            "value": "192.30.252.0/22"
          },
          {
            "mechanism": "include",
            "qualifier": "pass",
            "value": "spf.protection.outlook.com"
          },
          {
            "mechanism": "include",
            "qualifier": "pass",
            "value": "_netblocks.google.com"
          }
        ],
        "qualifierAll": "softfail",
        "record": "v=spf1 ip4:192.30.252.0/22 include:spf.protection.outlook.com include:_netblocks.google.com include:_netblocks2.google.com include:mail.zendesk.com include:_spf.salesforce.com..."
      },
      "status": "ok",
      "tlsRpt": {
        "found": false,
        "record": null,
        "rua": []
      }
    }
  ]
}
```

## Status Codes

| Code | Status | Description |
|---|---|---|
| 200 | OK | The request succeeded and the JSON result is in the response body. |
| 400 | Bad Request | The JSON body is invalid or a parameter is out of range. |
| 401 | Unauthorized | The `x-api-market-key` header is missing or the key is not valid. |
| 403 | Forbidden | Your key does not have an active subscription that includes this endpoint. |
| 404 | Not Found | The path does not match an endpoint of this API. Check the Base URL and path. |
| 429 | Too Many Requests | You went over 10 requests per second or used up the units of your plan. |
| 500 | Internal Server Error | The request failed on the server. Retry once, then contact us if it continues. |
| 503 | Service Unavailable | The service is temporarily unavailable. Retry after a short wait. |

## Rate Limits

Every plan allows up to 10 requests per second. The Free trial includes 100 units, Pro includes 10,000 units per month for $19, and PAYG is billed $0.002 per unit. When you go over a limit, the API returns `429 Too Many Requests`. Throttle your requests, back off before retrying, and honour the `Retry-After` header when it is present.

## FAQ

*   **How do the two endpoints differ?**
    `/m/domain-whois-dns-lookup` covers registration, DNS records, the certificate and redirects. `/m/email-dns-dmarc-spf-check` grades the email security records and lists fixes.

*   **What happens with a domain that is not registered?**
    It returns a row with `registered` set to false and no registration data.

*   **Where does registration data come from?**
    From the RDAP service of each domain registry, which replaces classic WHOIS.

*   **How many units does a call use?**
    One unit per result returned. The `billed` field shows the count, and rows with an error or no match are free.

*   **Are identical requests cached?**
    Yes. Identical requests are cached for up to 6 hours, so repeat calls return quickly.

## Contact Us

If you have any questions or need support, reach out through the chat embedded on this page or email us at hello@magicapi.com.


WHOIS and RDAP data, SSL certificate expiry, DNS records, redirects and an email DNS audit with DMARC and SPF grades, for many domains per call.

Domain Security API: WHOIS, SSL Certificate, DNS, DMARC