DNS Doctor API: Diagnose-Endpoints für DNS, Mail & DNSSEC

Endpoint	Beschreibung
GET`/check/{domain}`	Full DNS health check Runs 25+ checks (delegation, SOA, MX, SPF, DKIM, DMARC, MTA-STS, TLS-RPT, web records, CAA, DNSSEC) and returns a score with findings and copy-ready fixes. Parameter: domain, lang ( Pflicht)
GET`/lookup/{name}/{type}`	Raw DNS lookup via DoH Parameter: name, type (* Pflicht)
GET`/propagation/{name}/{type}`	DNS propagation check across public resolvers Queries the same name and type on five public resolvers (cloudflare, google, alidns, dnssb, adguard) and reports whether all reachable resolvers agree on the answer set. Parameter: name, type (* Pflicht)
GET`/availability/{domain}`	Domain availability via RDAP Non-binding availability check via public RDAP. Important: TLDs without public RDAP (for example .de) return state "unknown" together with noRdapForTld=true; only the responsible registry decides at registration time. Parameter: domain* (* Pflicht)
GET`/dkim/{domain}/{selector}`	DKIM key check Fetches selector._domainkey.domain as TXT and inspects the DKIM key: key type, key length, revoked (empty p=) and testing (t=y) flags. If no DKIM record is found, found=false is returned with no further fields except status (the DNS RCODE). Parameter: domain, selector (* Pflicht)
GET`/dnssec/{domain}`	DNSSEC chain inspection Fetches DS and DNSKEY records, computes key tags and reports which DS entries match a published DNSKEY. status is "unsigned" (no DS), "valid" (resolver-validated and at least one DS matches) or "broken". Parameter: domain* (* Pflicht)
GET`/mail-check/{domain}`	Mail server check Resolves the MX hosts (forward), their reverse DNS (PTR) with FCrDNS match, and probes TCP availability of the common mail ports (SMTP, IMAP, POP3) and web ports. Only connects to public target IPs. Extra burst limit because port probes are expensive. Parameter: domain* (* Pflicht)
GET`/seo-check/{domain}`	SEO & AI visibility check Fetches the page (soft-404-guarded), robots.txt and metadata, then scores how well the domain is visible to search engines and AI assistants. Findings cover indexing, content, technical and AI-crawler access. Localized (?lang=de). Extra burst limit because each run makes several outbound requests. Parameter: domain, lang ( Pflicht)
GET`/idn/{name}`	IDN/Punycode conversion Converts a domain name between Unicode and ASCII (Punycode) form, in both directions. Pure conversion, no network access and no rate limit. Parameter: name* (* Pflicht)
POST`/generate/{kind}`	Generate SPF, DMARC, CAA or MTA-STS records Pure record builders, no DNS queries. Warnings and errors are returned as structured, machine-readable codes (for example "too-many-lookups"), never as display text; this is intentional so integrations can localize them. Parameter: kind* (* Pflicht)
POST`/header-analysis`	Email header analysis Parses a raw email header: Received hops with time deltas, Authentication-Results (SPF/DKIM/DMARC), key sender fields and a From/Return-Path alignment hint. Body: raw header as text/plain, or JSON {"raw": "..."}. Maximum size 64 KiB. Privacy: processing is ephemeral, nothing is stored or passed on; the response is sent with Cache-Control: no-store.
GET`/badge/{domain}.svg`	Embeddable DNS health badge (SVG) Parameter: domain* (* Pflicht)
POST`/mcp`	MCP server (Model Context Protocol) over JSON-RPC 2.0 Stateless MCP endpoint (Streamable HTTP transport) for AI assistants. Send JSON-RPC 2.0 messages; methods: initialize, tools/list, tools/call, ping. Every check is exposed as a tool (dns_health_check, dns_lookup, dns_propagation, domain_availability, dkim_check, dnssec_check, mail_check, seo_check, idn_convert, generate_record) calling the same engine as the REST endpoints, with the same auth and rate limits. In Claude, add as a connector with URL https://dns-doctor.com/mcp. This is JSON-RPC, not REST: the schemas below are a generic JSON-RPC envelope.

Endpoint

Beschreibung

GET/check/{domain}

Full DNS health check

Runs 25+ checks (delegation, SOA, MX, SPF, DKIM, DMARC, MTA-STS, TLS-RPT, web records, CAA, DNSSEC) and returns a score with findings and copy-ready fixes.

Parameter: domain*, lang (* Pflicht)

GET/lookup/{name}/{type}

Raw DNS lookup via DoH

Parameter: name*, type* (* Pflicht)

GET/propagation/{name}/{type}

DNS propagation check across public resolvers

Queries the same name and type on five public resolvers (cloudflare, google, alidns, dnssb, adguard) and reports whether all reachable resolvers agree on the answer set.

Parameter: name*, type* (* Pflicht)

GET/availability/{domain}

Domain availability via RDAP

Non-binding availability check via public RDAP. Important: TLDs without public RDAP (for example .de) return state "unknown" together with noRdapForTld=true; only the responsible registry decides at registration time.

Parameter: domain* (* Pflicht)

GET/dkim/{domain}/{selector}

DKIM key check

Fetches selector._domainkey.domain as TXT and inspects the DKIM key: key type, key length, revoked (empty p=) and testing (t=y) flags. If no DKIM record is found, found=false is returned with no further fields except status (the DNS RCODE).

Parameter: domain*, selector* (* Pflicht)

GET/dnssec/{domain}

DNSSEC chain inspection

Fetches DS and DNSKEY records, computes key tags and reports which DS entries match a published DNSKEY. status is "unsigned" (no DS), "valid" (resolver-validated and at least one DS matches) or "broken".

Parameter: domain* (* Pflicht)

GET/mail-check/{domain}

Mail server check

Resolves the MX hosts (forward), their reverse DNS (PTR) with FCrDNS match, and probes TCP availability of the common mail ports (SMTP, IMAP, POP3) and web ports. Only connects to public target IPs. Extra burst limit because port probes are expensive.

Parameter: domain* (* Pflicht)

GET/seo-check/{domain}

SEO & AI visibility check

Fetches the page (soft-404-guarded), robots.txt and metadata, then scores how well the domain is visible to search engines and AI assistants. Findings cover indexing, content, technical and AI-crawler access. Localized (?lang=de). Extra burst limit because each run makes several outbound requests.

Parameter: domain*, lang (* Pflicht)

GET/idn/{name}

IDN/Punycode conversion

Converts a domain name between Unicode and ASCII (Punycode) form, in both directions. Pure conversion, no network access and no rate limit.

Parameter: name* (* Pflicht)

POST/generate/{kind}

Generate SPF, DMARC, CAA or MTA-STS records

Pure record builders, no DNS queries. Warnings and errors are returned as structured, machine-readable codes (for example "too-many-lookups"), never as display text; this is intentional so integrations can localize them.

Parameter: kind* (* Pflicht)

POST/header-analysis

Email header analysis

Parses a raw email header: Received hops with time deltas, Authentication-Results (SPF/DKIM/DMARC), key sender fields and a From/Return-Path alignment hint. Body: raw header as text/plain, or JSON {"raw": "..."}. Maximum size 64 KiB. Privacy: processing is ephemeral, nothing is stored or passed on; the response is sent with Cache-Control: no-store.

GET/badge/{domain}.svg

Embeddable DNS health badge (SVG)

Parameter: domain* (* Pflicht)

POST/mcp

MCP server (Model Context Protocol) over JSON-RPC 2.0

Stateless MCP endpoint (Streamable HTTP transport) for AI assistants. Send JSON-RPC 2.0 messages; methods: initialize, tools/list, tools/call, ping. Every check is exposed as a tool (dns_health_check, dns_lookup, dns_propagation, domain_availability, dkim_check, dnssec_check, mail_check, seo_check, idn_convert, generate_record) calling the same engine as the REST endpoints, with the same auth and rate limits. In Claude, add as a connector with URL https://dns-doctor.com/mcp. This is JSON-RPC, not REST: the schemas below are a generic JSON-RPC envelope.