Developer Updates
API Changelog
Track breaking changes, new features, and deprecations. We notify developers before making breaking changes.
Breaking changes are announced at least 12 months ahead. Read the versioning and deprecation policy.
Product update
More WHOIS coverage for country domains
- WHOIS lookups now recognize registered and unregistered domains under .ga, .jo and .sx. Blocked, timed-out and ambiguous responses remain unknown.
Product update
Business verification, sanctions screening, security rating and website compliance
- Validate an IBAN for any IBAN country, a BIC/SWIFT code and a US routing number with POST /v1/bank/validate (1 credit). A valid IBAN is split into bank code, branch code and account number. The check runs offline and bank details are not kept in request logs.
- Check VAT numbers with GET /v1/vat/validate (1 credit): EU and Northern Ireland numbers live with the EU VAT register and Norwegian numbers with the Norwegian business register, with the registered name and address where the country discloses them. UK, Swiss and Australian numbers are checked for format and check digits. When a register does not answer, the result is unknown and not charged.
- Validate Spanish DNI, NIE and NIF/CIF numbers with GET /v1/national-id/validate (1 credit), with the type of company and the correct control character when it is wrong.
- Look up and verify a US healthcare provider by NPI with GET /v1/npi, comparing a name, state and specialty with the record, or search providers by name with GET /v1/npi/search (1 credit each).
- Screen a person or company name against the US OFAC SDN and consolidated, UN, EU and UK sanctions lists with POST /v1/sanctions/screen (2 credits). Lists are refreshed daily, and no_match is returned only when every list is current.
- Grade a domain's security from A to F with GET /v1/security-rating (5 credits), from its certificate, security headers, email authentication, DNS, blocklist reputation and security contact. Areas that cannot be checked are left out of the score.
- Find a website's privacy policy, terms, cookie policy, imprint, privacy choices link, consent manager and trackers with GET /v1/legal-compliance (2 credits, 6 with render=true). Every new check also has an interactive tool.
Product update
More reliable WHOIS availability results
- WHOIS lookups no longer mistake a registry comment about an available contact form for an available domain. Explicit query limits remain unknown, including when a response also contains domain data.
- WHOIS lookups no longer treat a registry’s general rate-limit policy as a rejected query. Only an explicit limit response is reported as unknown.
- RDAP checks now respect retry delays after 403 or 429 responses. Unregistered names in confirmed closed brand extensions, including .microsoft, .google and .dhl, remain unavailable for public registration, keeping registration status separate from availability.
- WHOIS checks now recognize active .ma records as registered and an exact “Domain not found” reply on .sh as absent. Mixed, incomplete, or error replies remain unknown or unavailable and do not confirm registration or absence.
- WHOIS checks now recognize current registry replies for .ki, .bi, .ci, .ax, and .ls, and retrieve records more reliably for .cr and .sa. Conflicting, incomplete, malformed, denied, or throttled replies remain unconfirmed.
- WHOIS checks now recognize current registry replies for .gh, .do, .vu, .ar, and .ws. A missing contact record no longer makes a registered .mq domain appear available, and denied or throttled replies remain unconfirmed.
- WHOIS checks now recognize current registry responses for .bf, .td, .kn, .mr, .mc, and .ws, with lookup support for .tm. Queries for Chinese IDN domains under .中国 and .中國 now use the Unicode domain format required by the registry. Incomplete, denied, or throttled replies remain unconfirmed.
Product update
More accurate email, blocklist, lookalike and hosting results
- Email compliance reports SPF, DKIM or DMARC as unknown when its lookup fails, instead of failing the check and advising you to publish a record. Unknown checks are left out of the score, and a report where all three lookups fail is refunded.
- Email checks, email verification, DNS security, reputation, domain health and the email deliverability and phishing investigation recipes report a blocklist that could not answer as unknown instead of clean.
- Domain similarity decodes internationalized names and reports a lookalike that uses characters from another script, such as a Cyrillic а in apple.com, as a critical homograph.
- Hosting detection uses the most specific matching network range, so a provider inside a broad cloud block is named correctly. Email forwarding services such as addy.io and SimpleLogin are no longer flagged as disposable.
- Company lookup no longer keeps a result from a failed homepage or mail server lookup for a full day, and the Substack handle check now recognizes the platform's not-found page.
- Watchlist history, webhook deliveries and expiring domains handle invalid limit and days values instead of failing, the watchlist includes every monitored domain, and 30-day usage totals and comparisons now cover exactly 30 days.
Product update
More accurate blocklist, email, DNS and monitoring results
- Blocklist checks report a list that refused the query or could not be reached as unknown instead of clean, no longer count refusal codes as listings, and name listing categories correctly. Each list now has a status, and the result counts the lists that could not answer.
- Email verification reports an address as unknown and refunds the check when the mail server lookup fails, instead of rejecting it as a domain with no mail servers.
- IP lookups no longer flag a reverse DNS mismatch when the forward lookup fails, and domain change monitoring no longer reports DNS or email records as removed when a lookup fails.
- Page checks apply an X-Robots-Tag rule scoped to one crawler (such as otherbot: noindex) only to that crawler, scraped text keeps table cells and list items apart, and name checks report a handle that breaks a platform's rules as invalid instead of unknown.
- Domain lifecycle results read pendingRestore as expiring, pendingCreate as pending and serverHold as reserved. A brand monitor added again takes a fresh baseline, so earlier lookalikes are not alerted as new, and scrape jobs keep refunds owed for failed items until they are paid.
- Fixed translation errors in several languages, including notification channel names, domain status codes in glossary articles and Monitor page labels left partly in English.
Product update
More dependable domain monitoring alerts
- Check now on a monitored domain sends the same availability, status and expiry alerts as a scheduled check. Before, it saved the new state without alerting, so a change it found first was never alerted.
- A temporary lookup failure no longer marks a monitored domain as unknown or clears its expiry date, so it no longer sends a status change alert and a repeat expiry alert once lookups recover.
- The authentication section of the API docs now says correctly in every language that requests need an API key, and links to the dashboard where you manage it.
Product update
Fairer credit charges for MCP, batches and query options
- Page scraping through the MCP server is no longer charged twice, and accounts with purchased credits can use every scrape mode there.
- Credit charges now follow the options a request actually runs with: a repeated query parameter is priced by its first value, modes such as mode=DEEP are matched regardless of case, and true or false values such as TRUE, yes or 0 are priced the same way the endpoint reads them. Domain suggestions and typo checks accept the same true and false values as other endpoints.
- Batch jobs now refund an item whose result could not be confirmed and return the unused credits of an item that was only partly delivered, as single requests already did.
Product update
More reliable page, company and lookup checks
- Technology scans return page titles and descriptions with HTML entities decoded, page checks no longer fail on deeply nested structured data, ads.txt checks report a bot challenge page as blocked instead of invalid, and sitemap audits read Sitemap lines from a robots.txt served as HTML.
- Company lookups keep hyphenated names such as Coca-Cola and no longer report share or hashtag links as official social profiles.
- Steam handle checks report a temporary Steam error as unknown instead of no account found, RDAP lookups reject malformed IP ranges and AS numbers, and invalid unsubscribe links or usage periods return a clear error instead of failing.
Product update
More accurate reports, recipes and comparisons
- The domain report now returns the reputation score, blacklist status, recommendations and subdomain count, marks the DNS or subdomain section as failed when its lookups fail, and refunds a report where no section could be completed.
- The Brand Launch recipe now reports the real brand name score and keeps an unconfirmed registration status or unchecked social handles pending instead of passing them, and the Portfolio Audit no longer scores an incomplete health check as 0.
- Domain comparisons no longer describe a domain with unknown availability as registered, and now include registration and expiry dates.
- Availability checks for Unicode extensions such as .рф now query the registry directly, and domain age in years counts whole years up to the registration anniversary.
Product update
More accurate DNS, hosting, typo and page checks
- DNS lookups no longer label an alias (CNAME) answer as an A record, CDN detection no longer reports Amazon CloudFront and other caches as Fastly, and parking detection no longer flags sites that only link to domains such as jordan.com.
- Typo checks now include multi-letter look-alikes such as rn for m and vv for w, and MAC lookups classify device types by whole vendor names.
- Page checks treat robots "none" as noindex, no longer fail on unusual character codes, count words correctly in Hindi, Tamil and other scripts with combining marks, flag content as needing JavaScript only when rendering adds it, and treat Disallow: /* as blocking AI crawlers.
Product update
Reliability fixes for sign-in, tools and checks
- Sign-in, sign-up, the workspace monitor and 24 tool pages work again in French, Italian and Turkish, where some translated text stopped the page from loading.
- DNS and email authentication checks read DKIM keys published in several parts, read the DMARC policy correctly when sp= comes first, count SPF lookups for every mechanism and report a failed DNS lookup as unavailable instead of a missing record.
- The Suggestions tool now uses the extension and availability option you choose, and the domainers page shows the correct credit cost for each API.
- Typo, suggestion and name checks handle invalid limits and repeated inputs, phone validation keeps written extensions, and vulnerability, threat and MAC lookups return more accurate results.
Product update
Telegram handle checks show when no account uses a name
- Telegram handle checks now report a name with no Telegram account as claimability_unknown, shown as No account found, instead of rate_limited. Telegram shows the same page for unused names and when it limits requests, so a name is reported this way only when a known Telegram account loads correctly just before and just after it. Telegram offers no public way to confirm that a name can be registered, so it is never reported as available.
Product update
Clearer LinkedIn, Reddit, Telegram and Threads handle checks
- LinkedIn checks no longer fail on company pages served from country-specific LinkedIn addresses, and a page that was renamed is reported as taken.
- Reddit checks give a definite answer more often, and suspended Reddit accounts are reported as taken. Telegram reports short and system usernames as reserved, and reports a temporary Telegram limit as rate_limited instead of an error. Threads checks are faster.
- Bitbucket, Vimeo, Linktree, Tumblr, Behance, Gumroad, itch.io, Letterboxd, Patreon, Steam and Hacker News no longer report a name as available only because no public profile was found. Those names are reported as claimability_unknown, shown as No account found.
- Buy Me a Coffee and Substack now confirm availability with the username check each site runs before sign-up, and report names the site refuses as reserved.
Product update
New Name Availability API
- New Name Availability API (/v1/name-check) checks a name as domains across up to 20 extensions, as a handle on 20 social and developer platforms and as a package in npm, PyPI, crates.io, RubyGems, NuGet, Packagist and Homebrew, with a verdict and score. It has a free Name Checker tool and documentation.
Product update
New Robots.txt Tester API
- New Robots.txt Tester API (POST /v1/robots/test) checks up to 100 URLs against up to 10 crawlers in one request, using a robots.txt you paste or the live file, with the deciding rule, its line and syntax issues. It has a free tool page and documentation.
Product update
Seven new website analysis APIs
- New Site Audit API (/v1/site-audit) crawls up to 50 pages, follows robots.txt and reports broken internal links, redirects, duplicate titles and content, noindex and thin pages and on-page issues.
- New Screenshot API (/v1/screenshot) captures any page as PNG, JPEG, WebP or PDF on desktop or mobile, visible area or full page, in JSON or as the raw file.
- New Accessibility Audit API (/v1/accessibility) runs automated WCAG checks and returns violations by impact, affected elements and a score.
- New Cookie Scanner API (/v1/cookie-scan) lists cookies, trackers, third parties and the consent manager a page loads before consent, without collecting cookie values.
- New Page Weight API (/v1/page-weight) measures bytes and requests by type, largest files, third-party weight, render-blocking resources and load timings.
- New ads.txt API (/v1/ads-txt) validates ads.txt and app-ads.txt and confirms sellers against sellers.json.
- New Duplicate Content API (/v1/duplicate-content) compares up to 10 pages for near-duplicate content and repeated titles, meta descriptions and H1s. Each new API has a free tool page and documentation.
Product update
Six new on-page SEO APIs
- New On-page SEO Audit API (/v1/onpage) checks titles, meta tags, canonicals, robots directives, headings, content, links, images and structured data with 38 checks and a 0-100 score. Add render=true to audit the page after JavaScript runs.
- New JavaScript SEO API (/v1/onpage/render-diff) compares the raw and rendered HTML of a page and lists the SEO signals that only appear or change after JavaScript runs.
- New Structured Data API (/v1/structured-data) extracts JSON-LD, Microdata and RDFa and validates 26 common schema.org types, with errors and warnings for each property.
- New Keyword Density API (/v1/keyword-density) returns the top one, two and three word phrases with density and checks where target keywords appear.
- New Page Links API (/v1/links) lists every link with anchor text and rel values and, with check=true, finds broken links among up to 25 targets.
- New Hreflang API (/v1/hreflang) validates hreflang codes, x-default and self references, and confirms return links on up to 20 alternate pages. Each API has a free tool page, documentation and an MCP tool.
Product update
More accurate Facebook, Instagram and TikTok handle checks
- Facebook checks now return a clear answer for almost every handle and respond much faster. Handles with no Facebook account are reported as claimability_unknown, shown as No account found, instead of an error, and Facebook accepts handles from 1 character long.
- Instagram no longer labels private accounts as reserved. A handle that Instagram refuses at sign-up is reported as taken, and reserved is used only for names that break Instagram username rules. Instagram and Threads checks are also faster.
- TikTok private and restricted accounts are reported as taken instead of an error.
Product update
Nine more social platforms and stricter availability answers
- New platforms: Discord, Roblox, Kick, Chess.com, Minecraft, Mastodon (mastodon.social), Medium, npm and Lichess. Discord, Roblox, Kick and Chess.com use the username check each platform runs before sign-up, so they can confirm that a name is free.
- Instagram, X, Snapchat and Twitch now confirm availability with the username check those platforms run before sign-up. Names they refuse, such as reserved or banned names, are reported as taken or reserved instead of available.
- Fewer handles are wrongly reported as available. TikTok, YouTube, Pinterest, SoundCloud, Hugging Face, Docker Hub and LinkedIn now report a name with no account as claimability_unknown, shown as No account found, because they offer no public way to confirm that it can be registered. DEV names used by podcasts are reported as taken.
- Threads reports a handle as taken when the matching Instagram account holds it. Telegram reports handles sold through its username marketplace as taken, and handles listed there for sale or auction as reserved.
- LinkedIn checks now recognise school and showcase pages, which share names with company pages.
Product update
More accurate and more complete social username checks
- Fewer handles are wrongly reported as available. Private Dribbble profiles, suspended or banned Twitch accounts, private GitLab groups and hidden users, Hacker News accounts that have never posted, and Hashnode and RubyGems usernames in a different letter case are now reported as taken. Bluesky names that Bluesky keeps back are reported as reserved.
- When a platform confirms that no account uses a handle but does not confirm that it can be registered, the result now says so: available stays null, reason is claimability_unknown and classification.status is absent. GitHub, Dribbble, Hashnode, RubyGems and Snapchat use this result, and the Social Handle Checker shows it as No account found. GitHub could not check these handles before.
- Bluesky now checks plain names such as brand as brand.bsky.social instead of rejecting them as invalid.
- More checks give a definite answer. Deactivated Bitbucket workspaces, hidden Tumblr blogs, private Vimeo members, unverified Linktree profiles, suspended X accounts and removed Patreon creators are now reported as taken instead of unknown, and Pinterest, Facebook, Patreon, itch.io, Behance and Hacker News checks answer faster.
- When a platform does not answer clearly, the check is retried once within the request time limit. If it still has no answer, a handle confirmed as taken in the last 30 days is reported as taken, with evidence.source set to stale_cache and the age of that evidence in cache_age_s. Earlier available results are never reused this way.
- If a platform starts reporting well-known accounts as available, DomScan stops reporting handles as available on that platform until its answers are correct again. Those results are unknown, with evidence.source set to canary_quarantine.
Product update
One credit per pair across domain pricing
- Each unique TLD and selected registrar pair actually checked costs 1 credit across GET /v1/prices, GET /v1/prices/tld/:tld, POST /v1/prices/bulk for up to 50 unique TLDs, and GET /v1/prices/compare. GET /v1/prices requests for more than 5 TLDs also cost 1 credit per pair. The catalog remains free when tlds is omitted.
- In /v1/prices/compare, a standard row and a live exact-domain quote for the same pair are billed once together. Duplicate TLDs and registrar IDs are counted once, and registrar filters reduce planned and actual checks and credits charged.
- A failed or unknown exact quote is refunded only when no standard price row for that pair is returned.
- When a daily source refresh fails quality checks, its last accepted prices are retained, and the source stays out of recommendations until a valid refresh succeeds.
- Standard and bulk price lookups now accept supported compound extensions from the current pricing catalog, even when they are absent from the domain-checking list.
Product update
More reliable Telegram username checks
- Telegram checks now return unknown when a contact page or missing public page cannot confirm username availability. Exact public channel and bot matches still identify existing profiles.
Product update
Safer AI app connections, team invitations and pages
- Connections from AI apps through MCP now expire one year after you approve them, and an app can revoke its own connection at any time. Existing connections keep working for at least 30 more days.
- Team invitation emails no longer put the account name in the subject or heading and always show who sent the invitation. Account names can no longer contain links, web addresses or email addresses.
- Every page now runs only the scripts DomScan put there, so injected code is blocked by the browser even if it reaches a page.
- When our abuse protection blocks a new sign-up, the sign-in form now says the email was not sent instead of appearing to succeed.
Product update
Five checks now have their own product pages
- The robots.txt, XML sitemap audit, security headers, security.txt and IDN homograph checks now appear as their own products in the product menu, the API catalog and their suite pages, each linking to its own API page.
- Each of the five checks also has its own page in the documentation navigation, so you can go straight to its parameters and examples.
Product update
Security hardening for sign-in and pages
- Google sign-in now requires a verified Google email, never replaces a Google account already linked to your DomScan account, and rejects sign-in requests sent from other sites.
- Pages and tools that show data from domains, registries and certificates now escape it everywhere, and the screen for connecting an AI app shows the exact address the authorization is sent to.
Product update
Better on phones, and four tools fixed
- The site, free tools, documentation and dashboard were reviewed on phones: comparison and cost tables stack into readable rows, buttons and links are easier to tap, and form fields no longer zoom the page on iPhone.
- The tech stack, agent readiness, watchlist and email verification tools work again after a script error stopped their results, and the DKIM checker now lists the selectors it finds.
Product update
Interactive API docs: Try it for POST, your key in code samples and full search
- Try it now runs GET and POST examples from the docs with your signed-in account, and shows the credit cost before you choose to run the request.
- Paste your API key once to fill it into every code sample on the docs pages and into copied code. The key stays in your browser tab, and Forget key removes it.
- Every endpoint now has cURL, Node.js, Python, Go and Ruby examples, and your chosen language is remembered across docs pages, including product docs.
- Press Cmd+K or Ctrl+K to search section titles, headings, endpoint paths and parameter names across the whole API documentation.
- Docs pages now show when their content last changed, and every docs page asks whether it was helpful, with an optional comment.
Product update
AI-ready API documentation
- Every docs page now has a Markdown version at the same address with .md added, and /llms-full.txt holds the complete documentation in one file for AI assistants.
- A menu next to each docs page title copies the page as Markdown, shows the Markdown version, or opens the page in ChatGPT, Claude, Perplexity or Cursor.
- Ask AI (Ctrl+I or Cmd+I) sends your question to ChatGPT or Claude together with links to the docs, so answers are based on the current documentation. DomScan does not see your question.
Product update
Rate limits count by verified identity
- Rate limits on public endpoints now always count by client address unless a valid API key is used. An X-API-Key or Authorization header that is not verified no longer changes which limit applies.
- Requests made with a valid API key or a signed-in session count toward your account's limit, shared across all of its keys. The X-RateLimit-Policy header reports this as scope=account.
Product update
One-click MCP install and a guide for AI agents
- The MCP page and the API docs now have Add to Cursor and Add to VS Code buttons, plus copyable Claude Code and Codex commands, so you can connect DomScan without editing a config file.
- A new guide at /docs/ai-agents explains when to use MCP or the REST API, covers setup for Claude Code, Cursor, VS Code, Codex, ChatGPT, Claude and Windsurf, and includes an AGENTS.md snippet and ready-made prompts.
- The docs sidebar now links to the changelog, system status, the API playground and the public agent guide.
Product update
Public system status page
- A new status page at /status shows whether each API product family is operational, degraded or in an outage, based on requests from the last 15 minutes.
- Each product family shows its current p95 response time and 90 days of daily uptime.
- Ongoing incidents and incidents resolved in the last 30 days are listed with timestamps and plain-language updates.
Product update
A shorter MCP tool list
- The MCP server now lists 98 tools instead of 153, so agents load about 20% less tool text. Single and bulk checks share one tool: send a list such as domains instead of domain to run the bulk version.
- Related operations such as SSL checks, typosquatting analysis, SPF, DMARC and DKIM checks, job status and free reference data now share one tool with an action argument. Each tool description lists the credit cost of every action, and credits are charged exactly as before.
- Old tool names keep working until at least 2027-10-10. Tools that delete, cancel or remove something stay separate. The full list of old and new names is on the MCP page and at /mcp/tool-mapping.json.
Product update
Optional snake_case keys and a versioning policy
- Add naming=snake, or send the DomScan-Naming: snake header, to receive every camelCase response key in snake_case, for example registrar_name instead of registrarName. Values, error responses and credit costs are unchanged, and MCP tools accept the same naming argument.
- A new versioning policy explains which changes ship without notice and commits to at least 12 months of notice before any breaking change.
- Requests that use a deprecated alias, such as skip_cache, prefer_cache, refresh, offset or a numeric certificates cursor, now receive Deprecation, Sunset and Link headers. These aliases keep working until at least October 10, 2027.
Product update
Fewer false brand monitoring alerts
- Brand monitoring now reports a lookalike as a new threat only when a registration lookup confirms it is registered, the same rule the lookalike watchlist alerts use. Uncertain, blocked or timed-out checks no longer count as threats and are checked again on the next scan.
- A lookalike already recorded for your brand stays in your baseline and is reported as resolved only when a lookup confirms it is no longer registered.
Product update
Safe retries and separate state for each marketplace subscriber
- Marketplace subscribers can send an Idempotency-Key header on supported POST requests. Retrying with the same key within 24 hours returns the original response. Keys, pagination cursors and rate limits are kept separate for each identified subscriber.
- Marketplace responses include the X-RateLimit and X-Data-Freshness headers and no X-Credits headers, because marketplace plans are billed per request. dry_run=true returns 400 DRY_RUN_NOT_AVAILABLE for marketplace subscribers.
Product update
Certificate, price, DNS and lookalike alerts
- Subscribe watched items to new alert events with /v1/watchlist/alerts: ssl.expiring, ssl.expired and ssl.changed for any hostname, price.dropped for a TLD price, dns.changed for the records of any hostname, and typosquat.detected for new lookalikes of a brand domain.
- Each subscription is opt in per item and per event, with a certificate expiry threshold of 30, 14, 7 or 1 days, a price drop percentage or target price, and the DNS record types to watch.
- Only exact evidence triggers an alert. Failed or timed-out checks change nothing, and certificate and DNS changes must be seen on two consecutive checks before they are sent.
- Checks are free. Each alert delivered to your signed webhook with a 2xx response costs 2 credits, the same as other monitoring alerts, and failed deliveries are refunded.
Product update
Freshness control and cursor pagination
- Endpoints that can answer from recently checked data, such as availability, subdomain, certificate, technology and website checks, accept max_age in seconds. Older data is checked again, max_age=0 always checks fresh, and responses report the age of the data in cache_age_s and the X-Cache-Age header. Credit costs are unchanged.
- WHOIS and DNS history, subdomains, certificates, watchlists, brand monitors and the disposable email domain list accept limit and cursor and return has_more and next_cursor. Requests without limit return the same results as before, and each page costs the same as one request.
- skip_cache, prefer_cache, refresh and offset keep working as deprecated aliases.
Product update
Structured MCP results and tool hints
- MCP clients on protocol version 2025-06-18 or later now receive structuredContent with the same JSON object as the text result, including results narrowed with fields or compact. Results in plain text or CSV stay text only.
- Every tool now has a title and hints that say whether it only reads data, changes saved items, deletes or cancels something, or contacts the internet.
- Tool descriptions no longer repeat the API path, which keeps the tool list shorter. Tool names, inputs, credit costs and text results stay the same, and errors are still returned with isError and the standard error object.
Product update
Field selection and compact responses
- GET and POST API requests accept an optional fields parameter with comma-separated dot paths, such as fields=domain,classification.status, and return only those fields. Paths that match nothing are listed in the X-Fields-Ignored header.
- compact=true removes serving metadata, such as timings and empty warning lists, without removing data fields. Both parameters also work on MCP tool calls, never change the credit cost and leave error responses unchanged.
Product update
One API for every async job
- GET /v1/jobs lists your API batches, domain discovery, technology scan and scrape jobs together, newest first, with limit and cursor pagination. Every job has the same shape for status, progress, credits and links, and its results page through GET /v1/jobs/:job_id/results.
- POST /v1/jobs/:job_id/cancel cancels API batch, domain discovery and technology scan jobs with one call, and unstarted items are refunded. Listing, reading and cancelling jobs is free, and the existing job endpoints keep working unchanged.
- Job creation endpoints accept notify_webhook. When the job finishes, your signed webhook endpoints receive one free job.completed, job.failed or job.cancelled event.
Product update
Cost estimates, safe retries and credit headers
- Every authenticated API response, including errors, now reports X-Credits-Charged, X-Credits-Remaining, X-RateLimit-Limit, X-RateLimit-Remaining and the new X-RateLimit-Reset, so you can track spending and limits from the headers alone.
- POST /v1/estimate returns the credits a request would cost, with a breakdown and notes, without running it. Bulk, compare, recipe and pricing endpoints also accept dry_run=true. Both are free.
- POST requests that charge credits accept an optional Idempotency-Key header. Retrying with the same key within 24 hours returns the original response without charging again.
Product update
One present, absent or unknown status across presence checks
- Availability, social handle, DNS and email authentication, security.txt, robots.txt, sitemap, security header, parking, typosquatting and SSL certificate responses now include a classification object with a status of present, absent or unknown, the evidence behind it and when it was checked. Existing fields are unchanged.
- Unknown results always carry a reason: blocked, rate_limited, timeout, ambiguous, upstream_error or unsupported. Blocked, rate-limited, timed-out and failed checks are never reported as absent.
- Fixed results that treated failed checks as missing: failed DNS lookups no longer report SPF, DMARC, DKIM, CAA, MTA-STS or DNSSEC as missing, unreadable homepages no longer report a domain as not parked, typosquatting checks no longer count unconfirmed names as registered, and security header recommendations are no longer built from blocked pages.
- Scores and grades no longer treat a failed check as missing. The DNS security score and the email authentication grade leave unknown checks out, report how many in the new checks_unknown and score_confidence fields, and return null when every check is unknown. The SSL grade is null with a grade_reason instead of F when no certificate could be read, social checks report blocked instead of rate_limited when a platform refuses access, and the reputation score reports unknown parking as null instead of not parked.
Product update
New credit costs for the domain pricing API
- Single standard price lookups keep their cost: /v1/prices/tld/:tld and /v1/prices requests for up to 5 TLDs cost 1 credit per TLD and registrar pair, and the free TLD catalog is unchanged.
- Larger catalogue requests now cost 2 credits per TLD and registrar pair. This applies to every POST /v1/prices/bulk request and to /v1/prices requests for 6 to 20 TLDs.
- In /v1/prices/compare, each registrar that returns a live exact-domain quote now costs 3 credits. If a live quote fails or its result is unknown, it costs 1 credit when that registrar's daily price is shown and nothing otherwise. Registrars shown from their daily price list still cost 1 credit, and checkAccounting reports liveQuoteChecks, creditsPerLiveQuote and creditsRefunded next to creditsCharged.
Product update
Domain price comparison covers five more providers
- Standard registration, renewal and transfer prices now include INWX, 101domain, Rebel.com, iwantmyname and Cosmotown.
- Sale prices, new-customer offers and dated campaigns are shown separately from regular prices. Extensions sold only for terms longer than one year are left out.
Product update
Correct certificate serial numbers and a documented DNS ALL lookup
- SSL grade and chain results no longer show a certificate transparency log entry ID as the certificate serial number. The serial number is returned when it is read from the live certificate and left out otherwise.
- The DNS lookup documentation and the OpenAPI specification now describe type=ALL, which returns every common record type in one request. They also describe fields that responses already returned, such as the remaining watchlist after a removal and the top-level totals in bulk WHOIS results.
Product update
Accurate DKIM key sizes and more complete API documentation
- DKIM checks now report the real public key size, for example 2048 bits for an RSA-2048 key instead of a larger estimate based on the encoded key length. Ed25519 keys report 256 bits and are no longer flagged as too small.
- The OpenAPI specification and SDK types now describe fields that responses already returned, such as DMARC alignment settings, SPF includes and status flags in availability results. Bulk availability checks also accept prefer_cache at the top level of the request body and now include a summary block.
Product update
One consistent error format across the API
- Every API error now returns the same JSON error object with a stable code, a readable message, its type and HTTP status, whether a retry can help, a request ID that matches the X-Request-Id header and a link to the relevant documentation.
- Unknown API paths now return a JSON 404 error, and supported paths called with the wrong HTTP method return a 405 error that lists the allowed methods. The error codes reference now includes retry guidance.
- Existing integrations keep working: error codes are not renamed, success responses are unchanged and fields some endpoints already returned, such as credits_remaining or purchase_url, stay in place during a compatibility period.
Product update
Single notification webhook retired for new setups
- The single webhook in notification settings can no longer be turned on, and its URL can no longer be set or changed. Accounts that already use it keep receiving alerts as before, with the same payload and signature.
- You can still disable or clear an existing single webhook, but it cannot be turned back on afterwards. Slack, Discord, Telegram and email notifications are unchanged.
- Move to signed webhooks from Monitor settings or the /v1/webhooks API for timestamped signatures, automatic retries, a delivery log, more alert types and up to 10 endpoints. Each delivered alert costs 2 credits.
Product update
Webhook secret rotation and pause emails
- Rotate the signing secret of an alert webhook endpoint from Monitor settings or with POST /v1/webhooks/:webhook_id/rotate-secret. Rotation is free, and the new secret is shown once.
- For 24 hours after a rotation, each alert is signed with both the new and the previous secret in X-DomScan-Signature, so your receiver can switch without missing alerts.
- When an endpoint is paused after repeated failures, you now get one email with the endpoint host, the last error and a link to enable it again. Enabling it resets the failure count.
Product update
Monitoring alerts on your own webhooks
- Register up to 10 HTTPS endpoints from Monitor settings or the /v1/webhooks API, and choose which watchlist, domain change and brand monitoring alerts each one receives.
- Every alert is signed with HMAC-SHA256 over a timestamp and the request body. Failed deliveries are retried with increasing delays, and an endpoint that keeps failing is paused until you enable it again.
- Each alert delivered with a 2xx response costs 2 credits. Failed deliveries are refunded and test events are free.
Product update
Domain price comparison covers nine more providers
- Standard registration, renewal and transfer prices now include OVHcloud, Gname, WordPress.com, WebNIC, NearlyFreeSpeech.NET, Hostiso, HostSailor, HostUS and VirMach.
- First-year offers and sale prices are shown separately from regular prices. Prices published only for a multi-year term are left out instead of being converted to a yearly figure.
Product update
Five new APIs: robots.txt, sitemaps, security headers, security.txt and IDN
- GET /v1/robots parses robots.txt, tests any user agent and path, and reports access for 14 AI crawlers. GET /v1/sitemaps discovers and audits XML sitemaps with URL counts, freshness and protocol issues.
- GET /v1/headers grades HTTP security headers and cookie flags, and GET /v1/security-txt validates security.txt files against RFC 9116.
- GET /v1/idn converts Unicode and punycode domains and detects lookalike characters. All five are available in the API, the MCP server and as free tools.
Product update
SSL checks no longer report unreadable certificates as expired
- The SSL expiry check returns a new certificate_status field. When the certificate cannot be read, the status is unknown and the response no longer reports it as expired.
- Domain reputation flags an invalid certificate only when there is certificate evidence. A site that does not answer over HTTPS gets a recommendation to check HTTPS instead.
Product update
Getting started checklist and faster pages
- New accounts see a short checklist on the dashboard: create an API key, make a first request and monitor a domain. Each step completes automatically from your account activity, and the checklist can be hidden.
- Pages load faster on repeat visits because shared styles and scripts are now downloaded once and reused across the site.
Product update
Redesigned website and dashboard with light and dark themes
- Every public page and the signed-in dashboard now support light and dark themes. DomScan follows your system setting by default, and the theme switch in the header lets you choose light, dark or system.
- A cleaner, more readable design across the site: clearer typography, calmer layouts and consistent components on product, documentation, pricing and account pages.
- The home page explains more directly what DomScan does, with a real request and response example next to the introduction.
Product update
More accurate domain and IP lookup results
- RDAP registration lookups now reject hostnames and ordinary subdomains as invalid inputs instead of reporting a temporary outage that may prompt an unnecessary retry.
- Taiwan domain (.tw) lookups are working again.
- Identity and vulnerability results now mark missing webpage evidence as partial or unknown instead of clean or empty. When a result is unavailable, its credits are refunded.
- IP lookups now reject domains that resolve only to private or reserved addresses before enrichment, with an accurate input error instead of a temporary failure.
Product update
More precise social username availability checks
- A generic Facebook or Threads profile page that returns ‘not found’ no longer counts as proof that a username is available.
- GitHub results now require the public profile to match the requested username exactly. The exact Threads check and results that already confirm a username exists remain unchanged.
Product update
AppSumo license activation and monthly credits
- Connect an AppSumo license to the DomScan account you are signed into, then use the deal across supported DomScan products.
- AppSumo tier changes and refunds update the monthly credit allowance. Unused monthly credits expire at the UTC calendar-month boundary, while separately purchased credits remain in the account.
Product update
More dependable domain registration results
- Availability checks now follow current registry support for each domain suffix, avoiding WHOIS requests where that service is not offered.
- Incomplete, contradictory, or blocked registry replies now stay unknown instead of being reported as registered or available.
Product update
More reliable domain checks
- Subdomain discovery can now check certificate records when earlier checks use most of the available time.
- Technology scans now allow a slow page request more time to finish before timing out.
- For `.io` and `.biz` domains, if RDAP reports no registration but WHOIS is rate limited, lookup results now show DNS-only data as uncertain and refund the request credits instead of returning a server error.
- WHOIS checks for `.io` and `.biz` now have more ways to retrieve registration evidence when a registry limits requests.
Product update
Certificate and subdomain results preserve uncertainty
- Certificate searches no longer treat rate-limited or malformed source responses as empty results. Subdomain discovery reports uncertainty when no source can provide evidence.
Product update
Unclear WHOIS replies stay unknown
- Generic WHOIS replies that are short or unrecognized now remain unknown instead of appearing available. Results still depend on exact, authoritative registry or RDAP evidence.
Product update
More reliable WHOIS checks for .mu, .africa and .sr
- When RDAP is unavailable, availability checks for `.mu`, `.africa`, and `.sr` use registry-specific WHOIS routing. Exact authoritative replies determine results; blocked or inconclusive responses remain unknown.
Product update
Registration availability is clearer
- The .apple registry is closed to public registration, so unregistered .apple names are no longer shown as taken or available.
- A .us WHOIS response that says no record was found while disclaiming availability now remains unknown.
Product update
RDAP coverage now marks unmeasured health clearly
- Coverage responses no longer report success or latency and error values when no live probe ran; those measurements are marked unmeasured.
- Live coverage checks make one probe per distinct RDAP host, so latency and error values describe that probe rather than historical performance.
Product update
Clearer WHOIS availability results
- The WHOIS lookup tool now shows an explicit Available or Taken result when registration data is limited.
- Availability checks for `.info` domains now use a more reliable connection path.
Product update
Fixed `.my` and `.com.my` availability results
- Availability searches for `.my` and `.com.my` domains now correctly distinguish available domains from registered domains.
Product update
More reliable website categorization evidence
- Unreachable websites now keep the existing unreachable reason in API errors instead of returning an empty reason.
- Interrupted page responses are rejected as incomplete evidence, while supported partial and cached fallback results continue to work.
Product update
Social username checker update
- Earlier username-check behavior has been restored while fixes for response handling and international text are retained.
Product update
Clearer technology results during website outages
- Fast technology scans now distinguish failed website connections and incomplete responses from empty pages.
- After a failed fetch, fast scans can return a previously verified result, clearly marked as stale. Requests with skip_cache=1 continue to bypass saved results.
Product update
Fewer unknown results for larger social pages
- Social username checks now return fewer unnecessary unknown results for larger pages, while malformed or blocked responses remain unknown.
- Social username checks now preserve accented and non-Latin text when reading profile pages, instead of corrupting it.
Product update
Safer social username results
- Social username checks handle unreadable responses more cautiously and keep uncertain results unknown.
- YouTube checks continue using other available evidence during temporary limits. An empty channel lookup alone no longer marks a username available.
Product update
AI request-log analysis recovers from brief connection failures
- AI analysis of request logs now retries once after a temporary connection failure within a bounded limit; requests that still fail remain errors.
Product update
More reliable scraping and WHOIS availability
- Scrape requests now distinguish unreachable target sites from DomScan platform failures more reliably, reducing unnecessary 503 responses.
- WHOIS and RDAP lookups are less likely to encounter transient availability errors during bursts of other checks.
- Improved TLS deep-scan startup reliability during concurrent activity; transient failed starts are refunded.
Product update
Threads username checks are more precise
- Threads username checks now use exact validation when public profile evidence is inconclusive, reducing unknown results without treating blocked or changed responses as available.
Product update
Account admins for shared billing
- Account owners can promote existing members to admins or return them to guest access from the Members page.
- Admins can view billing, manage payment methods and auto-recharge, and purchase credits for the shared account without becoming its owner.
Product update
GitHub reserved usernames resolve correctly
- GitHub username checks now distinguish unused but unavailable names from claimable names, so reserved routes are no longer reported as available.
Product update
Deleted Reddit usernames resolve correctly
- Usernames from deleted Reddit accounts are now identified as unavailable because Reddit does not recycle them.
Product update
Registrar pricing coverage now follows current evidence
- Registrar coverage pages and sitemap links now reflect current successful standard-source evidence and configured exact-domain integrations.
- Stale, quarantined, disabled, and metadata-only provider coverage is not published.
- Published provider pages make their available standard-price and exact-domain scope clear.
Product update
More resilient social username checks
- Facebook, Threads, and YouTube username checks now retry inconclusive public profile evidence before returning an unknown result.
- Threads rate limits and login walls remain explicit unknown results and are never presented as available usernames.
Product update
MAC, website scan, and hosted-domain lookups are more resilient
- MAC vendor lookups now recover from cold cache conditions and continue returning verified manufacturer data.
- Website vulnerability scans now recover from temporary page-fetch transport failures within the request window.
- WHOIS lookups for domains hosted under private platform suffixes now return limited DNS-backed evidence instead of an RDAP protocol error when registry data is not applicable.
Product update
IP lookups now return geolocation and network data reliably
- Fixed an issue that could return every geolocation and network field as null. IP lookups now return available location, coordinates, ASN, and organization data with clear freshness and attribution metadata.
- If IP intelligence is temporarily unavailable, the API now returns a retryable service-unavailable response and automatically refunds the request credit instead of returning a successful all-null result.
Product update
Agent Readiness scoring and expanded agent checks
- Agent Readiness now provides a transparent 0-100 score across discoverability, content, access policy, and capabilities, with separate confidence and check-level evidence.
- Expanded the audit to more than 35 bounded checks, including sitemaps, Markdown delivery, crawler policy, API catalogs, OAuth metadata, Agent Skills, WebMCP, remote MCP, and page structure.
- Unknown evidence is excluded from scoring and lowers confidence. Emerging features are labeled by maturity, and the audit does not execute discovered tools or act as an SEO ranking.
- Public HTML pages now support explicit `Accept: text/markdown` requests with `Vary: Accept` and canonical linkage, with a new Markdown sitemap and sanitized public agent guide for discovery.
Product update
DomScan API expands to the Postman API Network and prepares for Zyla
- The DomScan Postman workspace is now publicly available with the complete collection aligned to the current OpenAPI contract.
- A generated Zyla catalog with 106 marketplace-eligible operations, complete descriptions, examples, and provider-gateway authentication has been submitted for Zyla review.
- The submitted Zyla surface excludes account-bound workflows. Availability on Zyla begins after marketplace approval.
- The homepage footer now links to verified public DomScan listings on RapidAPI, Apify, and Postman.
Product update
Identity resolution now handles slow page lookups gracefully
- Website fetching now stays within a bounded lookup window below the identity-resolution request deadline.
- Unresolved single lookups return HTTP 200 with fetch_state: "unknown" and empty evidence, while bulk lookups return unknown data for affected items. Relevant credits are refunded.
Product update
Focused DomScan domain intelligence Actors for Apify
- Added a focused Apify Actor catalog for WHOIS/RDAP, DNS, domain health, SSL, technology, reputation, subdomain, valuation, and availability checks.
- Added structured per-target datasets and automation-ready outputs with explicit success and error status.
- Added successful-result pricing by Actor, with failed results excluded from successful-result billing and Apify platform usage charged separately.
Product update
Email preferences now distinguish no choice from opting out
- When an authentication flow did not show the optional email-guidance choice, it no longer records that missing choice as an explicit opt-out from onboarding or lifecycle emails.
- We also repaired only affected accounts where the missing choice can be proven, while preserving any later dashboard preference changes and unsubscribes.
Product update
RapidAPI catalog refreshed
- RapidAPI subscribers can call supported stateless endpoints with their marketplace key and no separate DomScan account.
- The catalog now includes 106 eligible operations with complete descriptions, request examples, and response examples for domscan.p.rapidapi.com.
- Legacy endpoints and account-backed workflows were removed so the listing matches its executable capabilities.
- Verified RapidAPI subscriber identities and plans now appear in the admin traffic report without storing marketplace API keys.
Product update
A full API playground in the dashboard
- Browse and search every public API endpoint from one interactive dashboard workspace.
- Build requests from the live API contract, edit JSON payloads, and run them with your signed-in session.
- Inspect formatted responses, status, timing, credit details, and ready-to-copy cURL, JavaScript, and Python examples.
- Open the API Playground directly from the signed-in sidebar, with active-page highlighting across desktop and mobile layouts.
- Work in a dedicated full-page playground with stronger contrast, clearer focus states, and more room for requests, responses, and generated code.
- Successful responses now replace the empty state correctly and use clearer, syntax-highlighted JSON on desktop and mobile.
Product update
API docs sidebar navigation, clarified
- Find endpoints faster with sticky search and actions that stay available while you browse.
- Browse collapsible categories with item counts, clearer hierarchy, and stronger current-page highlighting.
- Use the keyboard shortcut to focus search, with responsive layouts that keep navigation readable on smaller screens.
v2.15.0
API v2.15.0: clearer responses and typed SDKs
- API responses now include additive headers for request IDs, credits requested, charged, refunded, and remaining, rate-limit details, response time, API version, and data freshness. Existing response bodies are unchanged.
- Errors now return a consistent, actionable shape with an error type, code, HTTP status, retry guidance, request ID, and a link to relevant documentation.
- The interactive quickstart now remembers your preferred language and lets you run a real availability request with your API key, then shows response time, credits charged, and request ID.
- The TypeScript and Python SDKs reach v0.3.0 with generated request and response types, full-response metadata, structured error classes, and safe retries that honor Retry-After and require idempotency keys for write retries.
Product update
Privacy and cookie policies updated for product analytics
- The cookie policy now documents the PostHog analytics cookie, what it stores and how long it lasts.
- A new session replay section explains that recordings only run once you accept analytics cookies, that everything you type is masked, and that domains and email addresses are removed from page addresses and titles.
- PostHog is listed as a subprocessor, with its purpose, the data it receives and its European Union storage region.
Product update
More reliable social username checks
- Exact present and missing-handle evidence is now used across more supported social, creator, and developer platforms.
- Ambiguous, blocked, rate-limited, malformed, or identity-mismatched responses remain unknown instead of being presented as available.
- Improved profile and channel redirect handling marks a name as taken only when the returned identity matches the requested handle.
Product update
Safer, more consistent page checks
- Scraping, technology detection, categorization, redirects, and public-page checks now share one bounded retrieval policy.
- When primary retrieval capacity is temporarily unavailable, checks use a bounded backup path while preserving the same safety and result-classification rules.
- Browser-rendered and non-rendered checks now use the same classification safeguards for blocked, rate-limited, and unreachable targets.
Product update
Web page retrieval retry refinements
- Existing resilient retries now use a different request profile after a retryable block or error from a permitted public page.
- Rate-limited responses continue to skip retries.
Product update
Product discovery and navigation refresh
- Organized the catalog around six product suites and solution-led discovery, so visitors can move from a goal to the relevant products and APIs.
- Restored the interactive homepage with trust logos and a unified call to action for exploring products and getting started.
- Unified docs navigation, corrected locale-safe links, and kept product section navigation visible on desktop.
- Refined suite and solution pages with clearer action hierarchy, richer product and workflow cards, and responsive layouts that stay readable from desktop to mobile.
- Rebuilt provider comparisons around current first-party pricing, real billing units, and workload-specific tradeoffs instead of generic placeholders.
- Added a keyboard-friendly API finder to the homepage so visitors can search products by name, goal, input, or endpoint path and open the right API directly.
- Added a site-wide command palette for fast keyboard search across products, API endpoints, documentation, suites, and free tools.
v2.14.0
Evidence-First Vulnerability Intelligence
- Added GET /v1/vulnerabilities with exact OSV package and version correlation plus deterministic web security configuration findings.
- Added CISA KEV and FIRST EPSS prioritization, explicit unknown and partial coverage, and safe passive scanning without exploit payloads.
- Published a localized scanner tool, dedicated API guide, developer documentation, MCP and SDK support, and standard or deep scan pricing.
v2.13.0
Six New Bulk Data APIs
- Added batch endpoints for subdomain discovery, Certificate Transparency, email authentication, hosting detection, RDAP, and DNS resolver comparison.
- Each accepts up to 10 items, preserves input order, returns per-item errors, and charges the normal per-item rate.
- Updated endpoint credit rates, including WHOIS at 3 credits per request or submitted bulk domain. Current rates are available at /v1/pricing.
v2.12.0
Bulk Endpoint Credit Alignment
- Bulk endpoints now bill the same per-item credits as individual requests across every plan.
- Updated billing, pricing metadata, API docs, dashboard pricing, OpenAPI, Swagger, and Postman artifacts to use standard per-item bulk rates.
- Bulk endpoints remain available for batching work into fewer requests with the same per-item credit cost.
v2.11.0
API Guides & Pricing Refresh
- Added a dedicated API pricing page with clearer endpoint pricing, billing links, and plan guidance
- Localized API guide pages now share a unified layout with setup steps, examples, and next actions
- Expanded API reference coverage so more public endpoints have dedicated guide pages instead of index-only listings
- Improved MCP setup landing pages and developer actions across guide examples
- Guide and docs pages now bypass stale page cache more aggressively so updates appear faster
v2.10.1
Availability Confidence & ccTLD Fallbacks
- Availability responses now include a `confidence` field to distinguish authoritative registry answers from heuristic fallbacks
- Added DNS and WHOIS fallback handling for `.es` and similar registries that restrict direct availability checks
- Fixed `skipCache` mode dropping results when RDAP fails mid-request
- Improved handling for access-denied RDAP responses and transient registry dampening caches
v2.10.0
WHOIS Fallback Expansion
- TLD validation now uses live IANA bootstrap data across all routes
- Added WHOIS fallback for TLDs without RDAP bootstrap coverage and for registries with unreachable RDAP servers
- Bulk status checks can now fall back to WHOIS for unsupported TLDs instead of failing early
- WHOIS availability parsing now recognizes more multilingual registry responses
- `/v1/ip` now returns HTTP 400 for private and reserved IP ranges instead of 500
v2.9.0
Data Quality & Performance Upgrades
- Improved Spamhaus, tech detection, SSL, and reputation result quality across multiple intelligence endpoints
- Expanded KV caching and unified resolver and timeout handling for lower-latency lookups
- Improved bulk status error reporting and aligned OpenAPI auth examples with production behavior
- Refreshed public docs and localized metadata across API landing pages
v2.8.0
Website Categorization API Overhaul
- Website categorization now uses an IAB-inspired taxonomy with multi-signal scoring
- Responses include better-ranked categories, subcategories, and confidence scores
- Added bulk categorization support and caching for larger analysis jobs
- Docs and OpenAPI examples now reflect richer categorization responses and confidence thresholds
v2.7.0
Historical Data Reliability
- Expanded passive snapshot recording to strengthen `/v1/whois/history` and related historical views
- Fixed missed history writes caused by background persistence timing on some routes
- Historical tables now capture more consistent domain change data over time
- Added D1 retry handling and bulk endpoint fixes for transient failures
v2.6.0
Phase 4: New Capabilities & Data Enrichment
- New `/v1/parking` endpoint - detect parked domains and aftermarket listings via DNS, redirect, and HTML analysis
- New `/v1/whois/history` endpoint - track WHOIS changes over time with D1-backed snapshot storage
- Threat intelligence now aggregates URLhaus + Spamhaus DBL + heuristic patterns
- Domain valuation anchored to real market sale data with comparable categories
- Hosting detection fetches dynamic IP ranges from AWS, GCP, and Cloudflare (cached 24h in KV)
- SPF validation now counts recursive DNS lookups (RFC 7208 10-lookup limit)
- Open Graph, Twitter Card, and meta tag extraction added to `/v1/tech`
- DKIM checking expanded from 10 to about 50 selectors covering all major ESPs
- DNS queries now fall back to Google DoH when Cloudflare is unavailable
- Error cache uses type-specific TTLs for smarter retry behavior
- Budget state is persisted so it survives application restarts
- Added IPv6, security.txt, BIMI, MTA-STS, HTTPS/SVCB, domain age, and transfer_locked fields
v2.5.0
Multi-currency Support
- Added GBP and JPY currency support for domain valuation
- New `currency` parameter on `/v1/value` endpoint (default: USD)
- Valuation responses now include `currency` field
v2.4.2
Mobile Experience Improvements
- Fixed mobile navigation UI issues
- Added floating navigation menu for API docs on mobile
- Improved terminal component responsive behavior
v2.4.1
Security Hardening
- Enhanced input validation across all endpoints
- Added rate limiting protection for authentication endpoints
- Improved XSS protection on user-generated content
- Security headers now enforced on all responses
v2.3.0
Reverse Lookup APIs
- New `/v1/reverse/mx` endpoint - find domains by mail server
- New `/v1/reverse/ip` endpoint - find domains hosted on an IP
- Both endpoints support pagination via `offset` and `limit` params
- Results include confidence scores and last-seen timestamps
v2.2.1
RDAP Reliability Improvements
- Fixed intermittent timeouts with certain ccTLD registries
- Improved retry logic for rate-limited RDAP servers
- Better handling of malformed RDAP responses
- Cache now respects registry-specific TTL hints
v2.2.0
Email Authentication API
- New `/v1/email-auth` endpoint for email security auditing
- Validates SPF, DKIM, and DMARC configurations
- Returns actionable recommendations for misconfigured records
- Includes deliverability score based on authentication setup
v2.1.0
Response Format Standardization
- BREAKING: Error responses now use consistent `error.code` and `error.message` format
- BREAKING: Removed deprecated `err` field from all responses
- BREAKING: HTTP 429 responses now include `retry_after` in seconds (was milliseconds)
- Added `error.suggestion` field with actionable guidance
- All timestamps now in ISO 8601 format
Migration Example
// Before (v2.0.x)
{ "err": "rate limited", "retry": 5000 }
// After (v2.1.0+)
{
"error": {
"code": "RATE_LIMITED",
"message": "Too many requests",
"suggestion": "Reduce request frequency or upgrade plan",
"retry_after": 5
}
}
v2.0.3
Bulk Endpoint Stability
- Fixed race condition in bulk status checks causing duplicate results
- Improved memory efficiency for large bulk requests
- Added request deduplication for identical domains in same batch
v2.0.2
Performance Optimizations
- Reduced average response time by 35% through edge caching improvements
- Optimized DNS resolution with connection pooling
- Bootstrap data now refreshed in background without blocking requests
v2.0.1
IDN Domain Handling
- Fixed punycode conversion for internationalized domain names
- Improved validation for mixed-script domain labels
- Added support for new gTLDs with non-ASCII characters
v2.0.0
API v2 Launch
- BREAKING: All endpoints moved from `/api/` to `/v1/` prefix
- BREAKING: Authentication now requires API key in `X-API-Key` header (was query param)
- BREAKING: Rate limits now per-key instead of per-IP for authenticated requests
- New domain availability engine with 40% faster lookups
- Added support for 400+ new TLDs
- Introduced credit-based pricing model
- New dashboard for API key management
Migration Example
// Before (v1.x)
GET /api/check?domain=example.com&key=xxx
// After (v2.0+)
GET /v1/status?name=example&tlds=com
Headers: X-API-Key: xxx
v1.5.0
Tech Stack Detection
- New `/v1/tech` endpoint for website technology detection
- Identifies CDN providers, CMS platforms, frameworks, and analytics tools
- Detection based on HTTP headers, HTML patterns, and JavaScript fingerprints
v1.4.0
Domain Health Checker
- New `/v1/health` endpoint for comprehensive domain health checks
- Validates DNS configuration, SSL certificates, and security headers
- Added `/v1/health/quick` for lightweight checks (DNS only)
- Health scores now included in domain profile responses
v1.3.2
Certificate Transparency Improvements
- Fixed pagination for domains with 1000+ certificates
- Added wildcard certificate detection
- Improved certificate parsing for non-standard issuers
v1.3.1
Deprecation Notice
- Deprecated: `/api/*` endpoints will be removed in v2.0 (September(2025)
- Deprecated: Query parameter authentication (`?key=xxx`) will be removed in v2.0
- Added deprecation warnings in response headers for affected endpoints
- Migration guide available at /docs#migration-v2
v1.3.0
Typosquatting Detection
- New `/v1/typos` endpoint for brand protection
- Detects keyboard-based typos, homoglyph attacks, and TLD variations
- Threat scoring based on registration status and content similarity
- Webhook notifications for newly registered typosquatting domains
Get Notified of Breaking Changes
Subscribe to receive email alerts before we ship breaking changes.