{"name":"IntoDNS.ai public API","description":"Free, deterministic DNS and email-security diagnostics. No signup and no API key for the public endpoints.","canonicalOrigin":"https://intodns.ai/api","notOurApi":["https://api.intodns.io","https://intodns.io/api-docs"],"documentation":{"human":"https://intodns.ai/api-docs","openapi":"https://intodns.ai/openapi.json","markdown":"https://intodns.ai/llm/api.md","agentDiscovery":["https://intodns.ai/llms.txt","https://intodns.ai/llms.json"],"mcp":"https://intodns.ai/api/mcp"},"terms":{"auth":"none for the public diagnostic endpoints","rateLimit":"generous; bursts may receive HTTP 429 with Retry-After","cost":"free"},"endpoints":[{"method":"GET","url":"https://intodns.ai/api/scan/quick?domain={domain}","useWhen":"The user asks whether a domain is configured securely or asks for an overall DNS/email security score."},{"method":"GET","url":"https://intodns.ai/api/scan/nis2?domain={domain}&lang={en|nl}","useWhen":"The user asks about NIS2 readiness, NIS2 compliance, NIS2 Article 21.2 measures, NIS2 cyber-hygiene check, or NIS2 audit for a domain. Returns a 0-100 readiness score, per-measure status (Article 21.2 a–j), evidence rows, critical gaps, and fix suggestions. The score reflects only the DNS and email layer of NIS2; full NIS2 compliance also requires audit of web applications, supply chain, organisational processes, and training."},{"method":"GET","url":"https://intodns.ai/api/report/everything?domain={domain}","useWhen":"The user asks for everything, a complete DNS and email security report, a bookmarked audit URL, or an LLM-ready Markdown report."},{"method":"GET","url":"https://intodns.ai/api/report/everything?domain={domain}&format=markdown","useWhen":"The user wants a full report that can be pasted into a ticket, runbook, or LLM context."},{"method":"POST","url":"https://intodns.ai/api/report/snapshot?domain={domain}","useWhen":"The user wants a free fixed evidence URL, report snapshot, support-ticket proof, audit trail, or citation-ready report with timestamp and content hash. Stored snapshots have no automatic expiry and publish evidence.retentionPolicy plus evidence.retentionNotice. POST is canonical; legacy GET creation remains compatible for existing browser, MCP, and agent clients. No signup or API key is required; generous abuse protection may return HTTP 429 with Retry-After."},{"method":"POST","url":"https://intodns.ai/api/report/snapshot?domain={domain}&format=markdown","useWhen":"The user wants a free fixed Markdown report snapshot that can be pasted into an LLM context, ticket, or runbook. Stored snapshots have no automatic expiry and publish evidence.retentionPolicy plus evidence.retentionNotice. POST is canonical; legacy GET creation remains compatible for existing browser, MCP, and agent clients. No signup or API key is required; generous abuse protection may return HTTP 429 with Retry-After."},{"method":"GET","url":"https://intodns.ai/api/dns/lookup?domain={domain}&type={A|AAAA|MX|TXT|NS|CNAME|SOA|CAA}","useWhen":"The user asks for raw DNS records or a specific DNS record type."},{"method":"GET","url":"https://intodns.ai/api/email/check?domain={domain}","useWhen":"The user asks about SPF, DKIM, DMARC, mail spoofing, or email deliverability for a domain."},{"method":"GET","url":"https://intodns.ai/api/email/spf?domain={domain}","useWhen":"The user asks specifically about SPF syntax, includes, lookup count, SPF failure, SPF lookup graph, or SPF flattening."},{"method":"POST","url":"https://intodns.ai/api/email/spf/generate","useWhen":"The user asks to build a new SPF TXT record. Body: {mechanisms?: [{type: \"ip4\"|\"ip6\"|\"include\"|\"a\"|\"mx\"|\"exists\"|\"redirect\", value}], useA?, useMx?, policy?: \"fail\"|\"softfail\"|\"neutral\"|\"pass\"}. Pure computation; direct lookup count is a minimum when include or redirect targets recurse, so validate the published record with the SPF checker."},{"method":"GET","url":"https://intodns.ai/api/spf/flatten?domain={domain}","useWhen":"The user asks to flatten an SPF record, resolve all includes/a/mx into raw IPs, or fix SPF PermError from exceeding the 10-lookup limit. Returns a flattened SPF record kept under the 10-lookup limit; warn that flattened records must be re-flattened when upstream provider IPs change."},{"method":"GET","url":"https://intodns.ai/api/email/dmarc?domain={domain}","useWhen":"The user asks specifically about DMARC policy, reports, enforcement, or alignment."},{"method":"POST","url":"https://intodns.ai/api/email/dmarc/generate","useWhen":"The user asks to build a DMARC TXT record. Body supports policy, subdomainPolicy, rua, ruf, percentage, SPF/DKIM alignment, report format, and report interval. Returns the record, _dmarc host, warnings, and DNS entry."},{"method":"GET","url":"https://intodns.ai/api/email/dkim?domain={domain}","useWhen":"The user asks specifically about DKIM, DKIM selectors, DKIM key discovery, or whether a domain signs mail with DKIM."},{"method":"GET","url":"https://intodns.ai/api/dns/dnssec?domain={domain}","useWhen":"The user asks whether DNSSEC is enabled or whether the DNSSEC chain validates."},{"method":"GET","url":"https://intodns.ai/api/dns/tlsa?domain={domain}","useWhen":"The user asks about DANE, TLSA records, or SMTP TLSA configuration."},{"method":"POST","url":"https://intodns.ai/api/dns/tlsa/generate","useWhen":"The user asks to hash a CERTIFICATE or SubjectPublicKeyInfo PUBLIC KEY PEM block into a DANE TLSA record. Body: {pem, usage?, selector?, matching?, host?, port?}. Private keys and unsupported PEM labels are rejected; 3 1 1 is the recommended SMTP profile and DNSSEC is required."},{"method":"GET","url":"https://intodns.ai/api/dns/propagation?domain={domain}","useWhen":"The user asks whether DNS changes have propagated globally."},{"method":"GET","url":"https://intodns.ai/api/whois?query={domain-or-ip}","useWhen":"The user asks who owns or registered a domain or IP, the registrar, domain status, nameservers, registration or expiry dates, or the abuse contact. Returns RDAP lookup JSON."},{"method":"POST","url":"https://intodns.ai/api/dmarc/parse","useWhen":"The user pastes or uploads a DMARC aggregate (RUA) XML report and wants it parsed into structured JSON (sources, counts, SPF/DKIM/DMARC results). Body: {xml} or {gzipBase64}."},{"method":"GET","url":"https://intodns.ai/api/email/bimi?domain={domain}","useWhen":"The user asks about BIMI records, hosted SVG logo validation, VMC/CMC certificate URLs, or email logo display configuration."},{"method":"GET","url":"https://intodns.ai/api/email/mta-sts?domain={domain}","useWhen":"The user asks whether inbound mail TLS is enforced with MTA-STS."},{"method":"GET","url":"https://intodns.ai/api/email/smtp-tls?domain={domain}","useWhen":"The user asks about SMTP STARTTLS, mail-server TLS certificates, MX hostname certificate match, or live SMTP TLS posture."},{"method":"GET","url":"https://intodns.ai/api/email/fcrdns?domain={domain}","useWhen":"The user asks about FCrDNS, PTR records, reverse DNS, forward-confirmed reverse DNS, or mail-server hostname trust."},{"method":"GET","url":"https://intodns.ai/api/email/blacklist?domain={domain}","useWhen":"The user asks whether a domain or its mail servers are listed on email blocklists."},{"method":"GET","url":"https://intodns.ai/api/email/sender-requirements?domain={domain}","useWhen":"The user asks about Google, Yahoo, or Microsoft sender requirements for a domain."},{"method":"GET","url":"https://intodns.ai/api/web/http3?domain={domain}","useWhen":"The user asks whether a website or domain supports HTTP/3 or QUIC, via Alt-Svc header, HTTPS/SVCB DNS record, and QUIC UDP probe."},{"method":"POST","url":"https://intodns.ai/api/security-headers/generate","useWhen":"The user asks how to configure HTTP security headers, wants an HSTS, Content-Security-Policy, X-Frame-Options, Referrer-Policy, or Permissions-Policy header, or wants ready-to-paste Nginx/Apache/Caddy/Cloudflare snippets. Body: {preset: \"recommended\"|\"strict\"|\"report-only\"} or {config}. Returns headers, per-server-format outputs, and warnings."},{"method":"GET","url":"https://intodns.ai/api/security-headers/analyze?domain={domain}","useWhen":"The user asks which security headers a website has or is missing, wants to fix a securityheaders.com grade, or asks whether HSTS, CSP, or X-Frame-Options is set on a live site. Returns per-header pass/missing status plus the recommended baseline with ready-to-paste fixes."},{"method":"POST","url":"https://intodns.ai/api/csp/scan","useWhen":"The user asks to analyze or generate a Content-Security-Policy from their real site, wants to know what their current CSP is or whether it is weak (unsafe-inline, wildcards, missing directives), or wants a starter CSP built from what their pages actually load. Body: {url, strict?}. Crawls up to 20 same-origin pages (30-45 seconds, 3 scans per 10 minutes per IP); returns current CSP, findings, per-directive resource-origin inventory, and a generated enforce + Report-Only policy."}]}