dns.pizza
APIFree · no API key

The dns.pizza JSON API

The same checks that power our report pages, as JSON — for scripts, CI pipelines, and AI agents. No signup, no key.

The basics

  • Anonymous callers get 30 lookups per minute per IP. Every JSON response carries X-RateLimit-Limit / X-RateLimit-Remaining / X-RateLimit-Reset headers; 429 means slow down.
  • Machine-readable spec: /api/openapi.json (OpenAPI 3.1). AI-assistant site map: /llms.txt.
  • Errors are structured: { error, code, details? } with meaningful HTTP status codes.
  • These endpoints answer point-in-time questions. To keep watching — uptime, DNS changes, certificate expiry, blacklists, with alerts by email, Slack, Discord, or webhook — monitoring plans start free.
POST/api/tools/domain-age

Domain age: registration/expiry dates, registrar, Internet Archive history

RDAP/WHOIS registry dates plus first/latest Wayback Machine captures. Partial results are a feature: registry data still returns when archive.org is down, and vice versa; only when BOTH sources come back empty is the response a 404. Optional `part` runs half the check — "whois" answers in well under a second, "wayback" can take up to ~8s when archive.org is degraded; part-requests always return 200 (the skipped half is null) so callers can merge halves.

curl -s -X POST https://dns.pizza/api/tools/domain-age \
  -H 'Content-Type: application/json' \
  -d '{"domain":"example.com"}'
POST/api/tools/email-auth

Email authentication: SPF, DKIM (common selectors), DMARC, MX

Checks SPF syntax and qualifier, DKIM keys across common selectors, DMARC policy/alignment/reporting, and MX records, with an overall 0–100 score and plain-language recommendations. DKIM covers common selectors only — a custom selector not found here can still exist.

curl -s -X POST https://dns.pizza/api/tools/email-auth \
  -H 'Content-Type: application/json' \
  -d '{"domain":"example.com"}'
POST/api/tools/ssl

Live TLS certificate: issuer, expiry, SANs, protocol, cipher

Performs a real TLS handshake against port 443. A dead or misconfigured host still returns 200 with `valid: false` and an `error` field — the handshake outcome IS the answer.

curl -s -X POST https://dns.pizza/api/tools/ssl \
  -H 'Content-Type: application/json' \
  -d '{"domain":"example.com"}'
POST/api/dns/lookup

DNS records for a domain, one or many types

Resolves the requested record types (default: A, AAAA, MX, NS, TXT, SOA, CAA). `records[type] === null` with an entry in `queryErrors` means that lookup could not be completed — NOT that the records don't exist.

curl -s -X POST https://dns.pizza/api/dns/lookup \
  -H 'Content-Type: application/json' \
  -d '{"domain":"example.com"}'
GET/api/tools/domain-age/badge

Embeddable SVG domain-age badge

GET so it works as a plain <img> on third-party sites. Successful badges are edge-cached for a day per domain. Always returns an SVG body, even for errors.

curl -s 'https://dns.pizza/api/tools/domain-age/badge?domain=example.com'
GET/api/status

Live dns.pizza infrastructure health

The same data behind https://dns.pizza/status — component health and data freshness for the monitoring pipeline itself.

curl -s 'https://dns.pizza/api/status'
MCP/api/mcp

Model Context Protocol server for AI agents

The same checks as native MCP tools — plus get_fix_guide (provider-specific SPF/DMARC/CAA publishing steps) and list_monitoring_plans. Streamable HTTP, stateless, no auth; network checks share the rate limit above, tool discovery is free.

claude mcp add --transport http dns-pizza https://dns.pizza/api/mcp

Building an agent or integration?

The pattern we recommend: diagnose with these free endpoints, walk the user through the fix with our provider-specific fix guides, then set up a monitor so the fix stays fixed. Questions or higher-volume needs: contact us.