Domain Intelligence

Authentication

All requests require an API key passed via the X-API-Key header:

X-API-Key: your-api-key-here

Plans

Feature access and limits are determined by your API key's plan.

Pricing

Get started with a free plan or upgrade for higher limits and premium features.

Already a subscriber? Manage your subscription

Rate Limiting

Requests are rate-limited per API key using a sliding window. Every response includes rate limit headers:

When the limit is exceeded, the API returns 429 Too Many Requests. Wait until the Retry-After period expires before retrying.

Domain Intelligence

Look up one or more domains concurrently. Returns WHOIS, DNS, SSL, and HTTP header data by default for each domain. Optional flags enable additional lookups. All lookups run concurrently with a 30-second timeout.

Request Body

Domain Normalization

Domain names are normalized automatically. You can pass bare domains or full URLs with any scheme — the API extracts the hostname by stripping scheme prefixes, userinfo, ports, paths, query strings, and fragments. The result is lowercased. The domain field in the response shows exactly what was looked up. Raw IP addresses are rejected — use the IP Intelligence endpoint instead.

Example

curl -X POST https://api.securityaccelerated.com/v1/domain/lookup \
  -H 'Content-Type: application/json' \
  -H 'X-API-Key: your-api-key' \
  -H 'X-Client-Request-ID: req-001' \
  -d '{
    "domains": ["example.com"],
    "email_security": true,
    "subdomains": true
  }'

import requests

resp = requests.post(
    "https://api.securityaccelerated.com/v1/domain/lookup",
    headers={
        "X-API-Key": "your-api-key",
        "X-Client-Request-ID": "req-001",
    },
    json={
        "domains": ["example.com"],
        "email_security": True,
        "subdomains": True,
    },
)

if resp.status_code != 200:
    print("Error:", resp.json()["error"])
else:
    results = resp.json()
    for result in results:
        print(result["domain"], result["dns"]["a"])

package main

import (
    "bytes"
    "encoding/json"
    "fmt"
    "net/http"
)

func main() {
    body, _ := json.Marshal(map[string]any{
        "domains":        []string{"example.com"},
        "email_security": true,
        "subdomains":     true,
    })

    req, _ := http.NewRequest("POST",
        "https://api.securityaccelerated.com/v1/domain/lookup",
        bytes.NewReader(body))
    req.Header.Set("Content-Type", "application/json")
    req.Header.Set("X-API-Key", "your-api-key")
    req.Header.Set("X-Client-Request-ID", "req-001")

    resp, err := http.DefaultClient.Do(req)
    if err != nil {
        panic(err)
    }
    defer resp.Body.Close()

    if resp.StatusCode != http.StatusOK {
        var apiErr map[string]string
        json.NewDecoder(resp.Body).Decode(&apiErr)
        fmt.Println("Error:", apiErr["error"])
        return
    }

    var results []map[string]any
    json.NewDecoder(resp.Body).Decode(&results)
    fmt.Println(results[0]["domain"])
}

Response Structure

The response is always a JSON array, even for single-domain requests. Each element contains the core lookup results plus any optional fields that were requested.

[
  {
    "domain": "example.com",
    "cache_hit": false,
    "whois": { ... },
    "dns": { ... },
    "ssl": { ... },
    "headers": { ... },
    "email_security": { ... },
    "subdomains": { ... },
    "threat_intel": { ... },
    "risk": { ... },
    "errors": []
  }
]

Optional fields (screenshot, reputation, email_security, subdomains, ct_logs, bgp, fingerprint, threat_intel, dns_security) are only present in the response when requested. The risk object is computed automatically for every lookup — no request flag needed.

Invalid Domains

Invalid domains in a multi-domain request do not fail the entire request. They are included in the response with a validation error while valid domains return normally:

[
  {
    "domain": "example.com",
    "cache_hit": false,
    "whois": { "domain_name": "example.com", ... },
    "dns": { ... },
    "ssl": { ... },
    "headers": { ... }
  },
  {
    "domain": "notadomain",
    "errors": [{ "lookup": "validation", "message": "invalid domain name" }]
  }
]

Response Fields

whois -- Domain Registration

{
  "domain_name": "example.com",
  "registrar": "RESERVED-Internet Assigned Numbers Authority",
  "created_date": "1995-08-14T04:00:00Z",
  "updated_date": "2024-08-14T07:01:38Z",
  "expiry_date": "2025-08-13T04:00:00Z",
  "status": ["clientDeleteProhibited", "clientTransferProhibited"],
  "name_servers": ["a.iana-servers.net", "b.iana-servers.net"],
  "registrant": { "organization": "REDACTED FOR PRIVACY", "country": "US" }
}

dns -- DNS Records

{
  "a": ["93.184.216.34"],
  "aaaa": ["2606:2800:220:1:248:1893:25c8:1946"],
  "mx": [{ "host": "mail.example.com", "priority": 10 }],
  "ns": ["a.iana-servers.net", "b.iana-servers.net"],
  "txt": ["v=spf1 -all"]
}

ssl -- TLS Certificate

{
  "subject": "www.example.org",
  "issuer": "DigiCert Global G2 TLS RSA SHA256 2020 CA1",
  "not_before": "2024-01-30T00:00:00Z",
  "not_after": "2025-03-01T23:59:59Z",
  "expired": false,
  "days_until_expiry": 142,
  "sans": ["www.example.org", "example.net", "example.org"],
  "serial_number": "0F:BE:08:B0:85:4D:05:73:8A:B0...",
  "signature_algorithm": "SHA256-RSA"
}

headers -- HTTP Response

Security Headers Checked

{
  "status_code": 200,
  "headers": {
    "Server": "ECAcc (dcd/7D5A)",
    "Content-Type": "text/html; charset=UTF-8",
    "Cache-Control": "max-age=604800"
  },
  "security_headers": {
    "strict_transport_security": "max-age=31536000",
    "x_content_type_options": "nosniff",
    "x_frame_options": "DENY"
  }
}

screenshot -- Page Screenshot Pro

{
  "status_code": 200,
  "png": "iVBORw0KGgoAAAANSUhEUgAA..."
}

reputation -- Domain Reputation Pro

Provider Result

{
  "score": 35,
  "risk": "medium",
  "providers": [
    { "listed": true, "category": "phishing", "provider": "spamhaus_dbl", "return_code": "127.0.1.4" },
    { "listed": false, "provider": "surbl" },
    { "listed": false, "provider": "uribl" },
    { "listed": false, "provider": "spamhaus_zen" }
  ]
}

Providers

The following blocklists are checked: Spamhaus DBL, SURBL, URIBL, and Spamhaus ZEN.

Risk Levels

email_security -- Email Authentication

spf -- Sender Policy Framework

dmarc -- DMARC Policy

dkim -- DKIM Records

mta_sts -- MTA Strict Transport Security

Only present when a record exists at _mta-sts.<domain>. When the TXT record is found, the policy file at https://mta-sts.<domain>/.well-known/mta-sts.txt is fetched for the mode and MX patterns.

tls_rpt -- SMTP TLS Reporting

Only present when a record exists at _smtp._tls.<domain>.

bimi -- Brand Indicators for Message Identification

Only present when a record exists at default._bimi.<domain>.

{
  "spf": {
    "raw": "v=spf1 include:_spf.google.com -all",
    "version": "spf1",
    "mechanisms": ["include:_spf.google.com"],
    "all": "-all"
  },
  "dmarc": {
    "raw": "v=DMARC1; p=reject; rua=mailto:dmarc@example.com",
    "version": "DMARC1",
    "policy": "reject",
    "rua": "mailto:dmarc@example.com"
  },
  "dkim": [
    { "selector": "google", "found": true, "raw": "v=DKIM1; k=rsa; p=MIGf..." },
    { "selector": "default", "found": false }
  ],
  "mta_sts": {
    "raw": "v=STSv1; id=20240101T000000",
    "id": "20240101T000000",
    "policy_fetched": true,
    "mode": "enforce",
    "max_age": 86400,
    "mx_patterns": ["*.example.com"]
  },
  "tls_rpt": { "raw": "v=TLSRPTv1; rua=mailto:tlsrpt@example.com", "rua": "mailto:tlsrpt@example.com" },
  "bimi": { "raw": "v=BIMI1; l=https://example.com/logo.svg", "location": "https://example.com/logo.svg" }
}

subdomains -- Subdomain Enumeration

Subdomain Entry

{
  "count": 3,
  "capped": false,
  "subdomains": [
    { "domain": "www.example.com", "source": "crt.sh" },
    { "domain": "mail.example.com", "source": "crt.sh" },
    { "domain": "api.example.com", "source": "crt.sh" }
  ]
}

ct_logs -- Certificate Transparency Logs

CT Log Entry

{
  "count": 2,
  "capped": false,
  "entries": [
    {
      "logged_at": "2024-01-15T00:00:00",
      "not_before": "2024-01-15T00:00:00",
      "not_after": "2025-04-15T23:59:59",
      "issuer": "Let's Encrypt",
      "common_name": "example.com",
      "serial": "abc123def456"
    }
  ]
}

bgp -- BGP / ASN Enrichment

ASN Record

{
  "records": [
    {
      "ip": "93.184.216.34",
      "asn": 15133,
      "prefix": "93.184.216.0/24",
      "country": "US",
      "registry": "arin",
      "description": "EDGECAST, US"
    }
  ]
}

fingerprint -- Technology Fingerprinting

Detects web servers, frameworks, CDNs, CMS platforms, and programming languages from HTTP response headers. No extra HTTP requests are made -- detection uses the headers already fetched. Approximately 90 technologies are covered.

Technology Entry

{
  "count": 2,
  "technologies": [
    { "name": "Nginx", "category": "web-server", "version": "1.25.3", "confidence": "header" },
    { "name": "Cloudflare", "category": "cdn", "version": "", "confidence": "header" }
  ]
}

Categories

web-server, language, framework, cdn, cms, analytics, security, hosting, cache, javascript, other

threat_intel -- Threat Intelligence Pro

Queries external threat intelligence feeds concurrently and returns an aggregated risk assessment. Three providers are queried: VirusTotal (70+ antivirus engines), URLhaus (Abuse.ch malware URL database), and AlienVault OTX (community threat pulses).

Provider Result

{
  "risk_level": "medium",
  "score": 45,
  "categories": ["malware"],
  "providers": [
    {
      "provider": "virustotal",
      "detected": true,
      "score": 3,
      "categories": ["malware"],
      "details": "3/70 engines detected this domain"
    },
    {
      "provider": "urlhaus",
      "detected": false
    },
    {
      "provider": "alienvault_otx",
      "detected": true,
      "score": 20,
      "categories": ["malware"],
      "details": "5 threat pulses reference this domain"
    }
  ]
}

Scoring

The aggregate score is a weighted average across providers: VirusTotal (50%), URLhaus (30%), AlienVault OTX (20%). Risk levels map from the aggregate score: 0 = none, 1--20 = low, 21--50 = medium, 51--80 = high, 81--100 = critical.

dns_security -- DNSSEC & CAA

Checks DNSSEC deployment (DS records at the parent zone, DNSKEY records at the zone, signing algorithms) and CAA records via raw DNS queries. Available to all plans. Missing DNSSEC means DNS responses can be spoofed; missing CAA means any certificate authority can issue certificates for the domain.

dnssec

caa

Example

curl -X POST https://api.securityaccelerated.com/v1/domain/lookup \
  -H 'Content-Type: application/json' \
  -H 'X-API-Key: your-api-key' \
  -d '{
    "domains": ["example.com"],
    "dns_security": true
  }'

The dns_security object in the response:

{
  "dnssec": {
    "enabled": true,
    "ds_records": 1,
    "dnskey_records": 2,
    "algorithms": ["ECDSAP256SHA256"]
  },
  "caa": {
    "present": true,
    "records": [
      { "flag": 0, "tag": "issue", "value": "letsencrypt.org" },
      { "flag": 0, "tag": "iodef", "value": "mailto:security@example.com" }
    ]
  }
}

risk -- Aggregate Risk Score

A computed 0--100 weighted risk score included in every domain lookup response — no request flag needed and no extra network calls made. The score is derived from whichever lookups are present in the response and renormalized over the weights of the components that have data.

Risk Component

Component Weights

Components only contribute when their underlying lookup ran and returned data. A base lookup scores from SSL, security headers, and domain age alone; requesting threat_intel or reputation makes those signals dominate.

{
  "score": 28,
  "risk_level": "medium",
  "components": [
    { "component": "ssl", "score": 40, "weight": 0.1, "detail": "certificate expires in 12 days" },
    { "component": "security_headers", "score": 20, "weight": 0.1, "detail": "missing: content-security-policy, referrer-policy" },
    { "component": "domain_age", "score": 25, "weight": 0.1, "detail": "domain registered 210 days ago" }
  ]
}

Risk Levels

errors -- Partial Failures

Individual lookups can fail without blocking the rest of the response. Each error contains:

Full Response Example

A complete response with all optional features enabled (screenshot, reputation, email_security, subdomains, ct_logs, bgp, fingerprint, threat_intel, dns_security):

[
  {
    "domain": "example.com",
    "cache_hit": false,
    "whois": {
      "domain_name": "example.com",
      "registrar": "RESERVED-Internet Assigned Numbers Authority",
      "created_date": "1995-08-14T04:00:00Z",
      "expiry_date": "2025-08-13T04:00:00Z",
      "name_servers": ["a.iana-servers.net", "b.iana-servers.net"]
    },
    "dns": {
      "a": ["93.184.216.34"],
      "aaaa": ["2606:2800:220:1:248:1893:25c8:1946"],
      "ns": ["a.iana-servers.net", "b.iana-servers.net"],
      "txt": ["v=spf1 -all"]
    },
    "ssl": {
      "subject": "www.example.org",
      "issuer": "DigiCert Global G2 TLS RSA SHA256 2020 CA1",
      "not_after": "2025-03-01T23:59:59Z",
      "expired": false,
      "days_until_expiry": 142,
      "sans": ["www.example.org", "example.net", "example.org"]
    },
    "headers": {
      "status_code": 200,
      "headers": { "Server": "ECAcc (dcd/7D5A)" },
      "security_headers": {
        "strict_transport_security": "max-age=31536000",
        "x_content_type_options": "nosniff"
      }
    },
    "screenshot": {
      "status_code": 200,
      "png": "iVBORw0KGgoAAAANSUhEUgAA..."
    },
    "reputation": {
      "score": 0,
      "risk": "clean",
      "providers": [
        { "listed": false, "provider": "spamhaus_dbl" },
        { "listed": false, "provider": "surbl" },
        { "listed": false, "provider": "uribl" },
        { "listed": false, "provider": "spamhaus_zen" }
      ]
    },
    "email_security": {
      "spf": { "raw": "v=spf1 -all", "version": "spf1", "all": "-all" },
      "dmarc": { "raw": "v=DMARC1; p=reject", "version": "DMARC1", "policy": "reject" },
      "dkim": [{ "selector": "default", "found": false }]
    },
    "subdomains": {
      "count": 2,
      "capped": false,
      "subdomains": [
        { "domain": "www.example.com", "source": "crt.sh" },
        { "domain": "mail.example.com", "source": "crt.sh" }
      ]
    },
    "ct_logs": {
      "count": 1,
      "capped": false,
      "entries": [
        { "logged_at": "2024-01-15T00:00:00", "issuer": "Let's Encrypt", "common_name": "example.com", "serial": "abc123" }
      ]
    },
    "bgp": {
      "records": [
        { "ip": "93.184.216.34", "asn": 15133, "prefix": "93.184.216.0/24", "country": "US", "description": "EDGECAST, US" }
      ]
    },
    "fingerprint": {
      "count": 1,
      "technologies": [
        { "name": "ECAcc", "category": "cdn", "version": "", "confidence": "header" }
      ]
    },
    "threat_intel": {
      "risk_level": "none",
      "score": 0,
      "providers": [
        { "provider": "virustotal", "detected": false },
        { "provider": "urlhaus", "detected": false },
        { "provider": "alienvault_otx", "detected": false }
      ]
    },
    "dns_security": {
      "dnssec": { "enabled": true, "ds_records": 1, "dnskey_records": 2, "algorithms": ["ECDSAP256SHA256"] },
      "caa": { "present": true, "records": [{ "flag": 0, "tag": "issue", "value": "letsencrypt.org" }] }
    },
    "risk": {
      "score": 4,
      "risk_level": "low",
      "components": [
        { "component": "threat_intel", "score": 0, "weight": 0.35, "detail": "aggregate threat intelligence score across 3 providers" },
        { "component": "reputation", "score": 0, "weight": 0.25, "detail": "DNS blocklist reputation score" },
        { "component": "ssl", "score": 0, "weight": 0.1, "detail": "certificate valid" },
        { "component": "security_headers", "score": 30, "weight": 0.1, "detail": "missing: content-security-policy, x-frame-options, referrer-policy" },
        { "component": "email_security", "score": 0, "weight": 0.1, "detail": "SPF and DMARC configured" },
        { "component": "domain_age", "score": 0, "weight": 0.1, "detail": "domain registered 11254 days ago" }
      ]
    },
    "errors": []
  }
]

Caching

Results are cached for 60 minutes. The cache_hit field on each response indicates whether data was served from cache or fetched live.

Error Handling

Error Response Format

All error responses use this format:

{
  "error": "description of the problem"
}

Request Correlation

You can pass an optional X-Client-Request-ID header with your own correlation ID for end-to-end tracing. The API echoes it back in the response headers and includes it in server-side logs.

What's New