Domain & Mail Security API

7 endpoints

Click one to see its parameters and a ready-to-paste curl call.

POST /v1/domain/mail-security Full SPF, DKIM, DMARC and MX audit with an A-F grade

Counts the SPF DNS lookups against the RFC 7208 limit of 10, walks every include, probes 28 common DKIM selectors, parses the DMARC policy, and checks MTA-STS, TLS-RPT, BIMI and DNSSEC.

Returns: json

Parameter	Type	Description
`domain` required	`string`	Domain or email address to audit.
`selectors`	`string`	Extra DKIM selectors to probe, comma-separated.

curl -X POST "https://173-249-18-142.sslip.io/v1/domain/mail-security" \
  -H "X-API-Key: $SMALLAPIS_KEY" \
  -H "Content-Type: application/json" \
  -d '{"domain":"example.com"}'

POST /v1/domain/dns Look up DNS records

Look up DNS records

Returns: json

Parameter	Type	Description
`domain` required	`string`	Domain to resolve.
`type`	`string`	Comma-separated record types. Default: `A,AAAA,MX,NS,TXT,SOA,CNAME`

curl -X POST "https://173-249-18-142.sslip.io/v1/domain/dns" \
  -H "X-API-Key: $SMALLAPIS_KEY" \
  -H "Content-Type: application/json" \
  -d '{"domain":"example.com","type":"A,AAAA,MX,NS,TXT,SOA,CNAME"}'

POST /v1/domain/tls Inspect the TLS certificate and chain

Returns the issuer, SANs, protocol, cipher and `daysRemaining` — enough to drive an expiry alert.

Returns: json

Parameter	Type	Description
`domain` required	`string`	Host to connect to.
`port`	`integer`	TCP port. Default: `443`

curl -X POST "https://173-249-18-142.sslip.io/v1/domain/tls" \
  -H "X-API-Key: $SMALLAPIS_KEY" \
  -H "Content-Type: application/json" \
  -d '{"domain":"example.com","port":443}'

POST /v1/domain/headers Grade the HTTP security headers

Scores HSTS, CSP, X-Content-Type-Options, Referrer-Policy, Permissions-Policy and the COOP/CORP pair, and flags version-leaking headers.

Returns: json

Parameter	Type	Description
`domain` required	`string`	Site to test.
`path`	`string`	Path to request. Default: `/`

curl -X POST "https://173-249-18-142.sslip.io/v1/domain/headers" \
  -H "X-API-Key: $SMALLAPIS_KEY" \
  -H "Content-Type: application/json" \
  -d '{"domain":"example.com","path":"/"}'

POST /v1/domain/whois Registration data for a domain

Queries the registry RDAP server found through the IANA bootstrap, and falls back to port-43 WHOIS for the registries that refuse RDAP to data-centre addresses (.io and .de among them), so the lookup works on every TLD. The `source` field says which one answered.

Returns: json

Parameter	Type	Description
`domain` required	`string`	Domain to look up.

curl -X POST "https://173-249-18-142.sslip.io/v1/domain/whois" \
  -H "X-API-Key: $SMALLAPIS_KEY" \
  -H "Content-Type: application/json" \
  -d '{"domain":"example.com"}'

POST /v1/domain/availability Check whether domains are registered

Check whether domains are registered

Returns: json

Parameter	Type	Description
`domains` required	`string`	Comma-separated list, up to 10.

curl -X POST "https://173-249-18-142.sslip.io/v1/domain/availability" \
  -H "X-API-Key: $SMALLAPIS_KEY" \
  -H "Content-Type: application/json" \
  -d '{"domains":"example.com,example.net"}'

POST /v1/domain/blacklist Check an IP or domain against 10 DNS blacklists

Check an IP or domain against 10 DNS blacklists

Returns: json

Parameter	Type	Description
`ip`	`string`	IPv4 address to check.
`domain`	`string`	Domain to resolve and check instead.

curl -X POST "https://173-249-18-142.sslip.io/v1/domain/blacklist" \
  -H "X-API-Key: $SMALLAPIS_KEY" \
  -H "Content-Type: application/json" \
  -d '{}'