The dns.pizza JSON API
The same checks that power our report pages, as JSON — for scripts, CI pipelines, and AI agents. No signup, no key.
The basics
- Anonymous callers get 30 lookups per minute per IP. Every JSON response carries X-RateLimit-Limit / X-RateLimit-Remaining / X-RateLimit-Reset headers; 429 means slow down.
- Machine-readable spec: /api/openapi.json (OpenAPI 3.1). AI-assistant site map: /llms.txt.
- Errors are structured:
{ error, code, details? }with meaningful HTTP status codes. - These endpoints answer point-in-time questions. To keep watching — uptime, DNS changes, certificate expiry, blacklists, with alerts by email, Slack, Discord, or webhook — monitoring plans start free.
/api/tools/domain-ageDomain age: registration/expiry dates, registrar, Internet Archive history
RDAP/WHOIS registry dates plus first/latest Wayback Machine captures. Partial results are a feature: registry data still returns when archive.org is down, and vice versa; only when BOTH sources come back empty is the response a 404. Optional `part` runs half the check — "whois" answers in well under a second, "wayback" can take up to ~8s when archive.org is degraded; part-requests always return 200 (the skipped half is null) so callers can merge halves.
curl -s -X POST https://dns.pizza/api/tools/domain-age \
-H 'Content-Type: application/json' \
-d '{"domain":"example.com"}'/api/tools/email-authEmail authentication: SPF, DKIM (common selectors), DMARC, MX
Checks SPF syntax and qualifier, DKIM keys across common selectors, DMARC policy/alignment/reporting, and MX records, with an overall 0–100 score and plain-language recommendations. DKIM covers common selectors only — a custom selector not found here can still exist.
curl -s -X POST https://dns.pizza/api/tools/email-auth \
-H 'Content-Type: application/json' \
-d '{"domain":"example.com"}'/api/tools/sslLive TLS certificate: issuer, expiry, SANs, protocol, cipher
Performs a real TLS handshake against port 443. A dead or misconfigured host still returns 200 with `valid: false` and an `error` field — the handshake outcome IS the answer.
curl -s -X POST https://dns.pizza/api/tools/ssl \
-H 'Content-Type: application/json' \
-d '{"domain":"example.com"}'/api/dns/lookupDNS records for a domain, one or many types
Resolves the requested record types (default: A, AAAA, MX, NS, TXT, SOA, CAA). `records[type] === null` with an entry in `queryErrors` means that lookup could not be completed — NOT that the records don't exist.
curl -s -X POST https://dns.pizza/api/dns/lookup \
-H 'Content-Type: application/json' \
-d '{"domain":"example.com"}'/api/tools/domain-age/badgeEmbeddable SVG domain-age badge
GET so it works as a plain <img> on third-party sites. Successful badges are edge-cached for a day per domain. Always returns an SVG body, even for errors.
curl -s 'https://dns.pizza/api/tools/domain-age/badge?domain=example.com'
/api/zone/censusZone census: what appeared in the DNS zones on a day and what was behind it
Daily aggregates from dns.pizza's zone census — births and deaths across ~1,050 gTLD zones (plus a .com/.net sample), the five-way split of newborns (active site / parked / registered-no-site / nothing / unknown), what the live sites are about, per-TLD counts, parking vendors and platforms — together with the day's risk-scorer summary (tiers, model-opinion counts, per-TLD flagged rates). Omit `day` for the newest day; `days` lists the 60 most recent days with headline numbers. Aggregates only; no domain is named here.
curl -s 'https://dns.pizza/api/zone/census'
/api/zone/census/tldsZone census per TLD: births, deaths and flagged-newborn rates
One row per TLD for the day: births and deaths from the zone diff, plus the risk scorer's flagged / high / critical counts and `highPer1k` (high-or-critical rows per 1,000 births; null under 100 births). `sort` = births (default), deaths, high or highPer1k.
curl -s 'https://dns.pizza/api/zone/census/tlds'
/api/zone/riskNewborn domains the risk scorer flagged on a day, with the evidence
Signals, not verdicts. Each row is a domain that appeared in the zone that day and matched name, infrastructure or first-day-page heuristics (typo of a brand, credential form on a brand page, nameserver born the same day, and so on), with every matched signal and its matching text, and — for the top rows — a model's opinion labelled as an opinion with its confidence. Nothing here is a finding that a site is malicious; look at the evidence and decide for yourself. `tier` is the minimum tier to include (default high). TLDs listed in `excludedTlds` are not shown. A dispute link is included in every response.
curl -s 'https://dns.pizza/api/zone/risk'
/api/zone/domain/{domain}What the zone census saw for one domain: born-on day, day-one state, risk flags
The day the domain first appeared in a zone the census watches, what was behind it that day (active site, parked, nothing, and its subject when live), and every day the risk scorer flagged it with the matched signals and any model opinion. `born: null` with an empty `risk` array means the census has no record of the name inside its retained window — it does NOT mean the domain is old or safe.
curl -s 'https://dns.pizza/api/zone/domain/example.xyz'
/api/statusLive dns.pizza infrastructure health
The same data behind https://dns.pizza/status — component health and data freshness for the monitoring pipeline itself.
curl -s 'https://dns.pizza/api/status'
/api/mcpModel Context Protocol server for AI agents
The same checks as native MCP tools — plus get_fix_guide (provider-specific SPF/DMARC/CAA publishing steps) and list_monitoring_plans. Streamable HTTP, stateless, no auth; network checks share the rate limit above, tool discovery is free.
claude mcp add --transport http dns-pizza https://dns.pizza/api/mcp
Building an agent or integration?
The pattern we recommend: diagnose with these free endpoints, walk the user through the fix with our provider-specific fix guides, then set up a monitor so the fix stays fixed. Questions or higher-volume needs: contact us.