API
Everything the scanner does, as JSON. No key needed for anonymous use.
curl "https://dnsdeets.com/api/v1/scan?domain=example.com"
Endpoints
| GET /api/v1/scan?domain= | Full scan. Cached 10 minutes (X-Scan-Cache header). |
| GET /api/v1/scan/stream?domain= | Same scan over SSE: stage events, then result. |
| GET /api/v1/scan/:id | Retrieve a stored scan (30-day retention for anonymous scans). |
| POST /api/v1/dkim | Check one DKIM selector: {"domain","selector"}. |
| GET /api/v1/checks | The full check catalog with severities and docs links. |
| GET /api/v1/openapi.json | OpenAPI 3.1 spec, generated from the response schemas. |
Rate limits
Anonymous: 20 scans / 10 minutes and 100 / day per IP, with a short burst limit. 429 responses include Retry-After. Higher limits come with free API keys in the Watch tier (soon).
Honesty contract
Fields the scan couldn't observe are null with assessed: false and are listed in meta.not_assessed. They never affect the score.