Everything a domain will tell you about itself, in one place
Domain Intelligence API returns live Domain Intelligence data as clean JSON for domain, dns and whois lookups.
12 active endpoints, on 0, 1 and 3 credit tiers.
- POST/domain-intel/v1/whois
- POST/domain-intel/v1/dns
- POST/domain-intel/v1/reverse_dns
- POST/domain-intel/v1/hosting
- POST/domain-intel/v1/dnssec
- POST/domain-intel/v1/ssl_certs
- POST/domain-intel/v1/subdomains
- +5 more
What Domain Intelligence endpoints does ReefAPI ship?
12 live read endpoints. Read-only data API: no writes, no account actions, no dashboard access on the target site.
Domain Intelligence API
3 of 12 endpoints, ready to run
The registration record: registrar, creation, update and expiry dates, registry status codes, name servers and whether DNSSEC is on.
{ "ok": true, "meta": { "api": "domain-intel", "endpoint": "whois", "mode": "live", "latency_ms": 673.6, "record_count": 1, "cache_hit": false, "completeness_pct": 100 }, "data": { "whois": { "domain": "GITHUB.COM", "unicode_name": null, "registry_domain_id": "1264983250_DOMAIN_COM-VRSN", "registrar": "MarkMonitor Inc.", "registrar_iana_id": "292", "reseller": null, "status": [ "client delete prohibited", "client transfer prohibited", "client update prohibited" ], "created": "2007-10-09T18:20:50Z", "updated": "2024-09-07T09:16:32Z", "expires": "2026-10-09T18:20:50Z", "transferred": null, "rdap_last_update": "2026-08-29T13:34:58Z", "nameservers": [ "DNS1.P08.NSONE.NET", "DNS2.P08.NSONE.NET", "DNS3.P08.NSONE.NET" ], "dnssec": false, "abuse_contact": { "phone": "+1.2086851750" } } } }
How the Domain Intelligence API works
Domain Intelligence is a normal ReefAPI surface — the same four rules that hold for every other engine on the key.
No OAuth app, no request signing, no per-site account. One key covers all 184 engines.
Every route is a POST with a JSON body. Parameters are validated against the published schema before anything is charged.
Credits, not seats. Failed and blocked calls are never charged, and cache hits cost nothing.
One envelope everywhere. meta carries latency_ms, record_count and the endpoint that answered.
Sizing up a domain you have just been sent
A new supplier, a partner request, a suspicious invoice. What you want first is the shape of the domain — how old, who registered it, what it runs — before anyone spends time on it.
{"domain": "stripe.com", "include_tech": true}Comes back with registration, DNS, DNSSEC, certificates, subdomains, technology and hosting as separate blocks in one response.
{"domain": "stripe.com"}On its own when you want the attack-surface view rather than the whole profile. It returned over a hundred names in under a second.
One call answers age, ownership, mail setup, certificate history and stack — the questions that otherwise mean four tools and a spreadsheet.
curl -X POST https://api.reefapi.com/domain-intel/v1/whois \
-H "x-api-key: $REEF_KEY" \
-H "content-type: application/json" \
-d '{"domain":"github.com"}'{
"ok": true,
"data": { … },
"meta": {
"api": "domain-intel",
"endpoint": "whois",
"mode": "live",
"latency_ms": …,
"record_count": …
},
"error": null
}Which surface answers which question, and where each one goes blank
This engine is a set of independent lookups over four different sources, and each one has a specific place where it stops having an answer. Knowing that place is usually the difference between filing a bug and making a second call to a different action. Every row was checked live against github.com, stripe.com, cloudflare.com, nic.fr or vercel.io.
| Action | Where the answer comes from | Where it goes blank, and what that looks like |
|---|---|---|
| whois | Registry RDAP | NOT_FOUND with rdap_status 404 on legacy-WHOIS-only TLDs; registrant is null on most .com records |
| dns | DNS over HTTPS | An RR type the resolver rejects fails the whole call with UPSTREAM_HTTP; it is not skipped |
| hosting | A and AAAA records, then IP-to-ASN | ipv6 is an empty array when the domain publishes no AAAA, as github.com did |
| ssl_certs | Certificate Transparency logs | serial_number is null on the fast source; pass deep=true for the full history |
| subdomains | SANs inside CT-logged certificates | Names never covered by a public certificate never appear; stripe.com returned 114 |
| dnssec | Resolver AD flag plus DS and DNSKEY | signed false on unsigned zones; issues[] carries the DS-without-DNSKEY warning |
| availability | Whether an RDAP record exists at all | Reports available:true for .io and .de even when registered; read `method` and `note` |
| tech_detect | Homepage response headers plus HTML | cdn can be [] even on a CDN-fronted site; the evidence lands in technologies instead |
| tld_detail | The IANA RDAP bootstrap file | has_rdap:false is advance warning that whois and availability will 404 for that TLD |
Dates are ISO 8601 with a Z: created "2007-10-09T18:20:50Z", expires "2026-10-09T18:20:50Z". Status flags are lowercase spaced EPP strings rather than camelCase: ["client delete prohibited", "client transfer prohibited"]. registrar_iana_id is a string ("292" for MarkMonitor) while hosting's asn is an integer (36459). The domain input is normalized for you, so "https://www.github.com/foo/bar" resolved to github.com.
Which parts are registry fact and which are observation
Measured across several well-known domains. The distinction in the first row runs through the whole engine.
The record comes from the registries themselves — registrar name and IANA id, creation, update and expiry timestamps, the status codes the registry has set, the name servers and the DNSSEC flag. Well-known domains answered in around half a second. Creation date and expiry are the two fields most fraud checks are really after, and they are exact rather than estimated.
Each record is returned with the time-to-live alongside the value, grouped by type. The TTL is what tells you whether you are looking at something stable or something that was changed recently, which a bare list of values cannot.
The stack view reports what the response actually shows — the server header, the CDN in front, the certificate validity and the frameworks it can identify from the page. It reads what is visible rather than claiming a full inventory, so treat a short technology list as 'what was detectable', not as 'all this site uses'.
Certificate history and discovered subdomains each return as their own list — fifty certificates and over a hundred subdomains on a large domain, both in well under a second. They are the two views that matter for attack surface, and neither is buried inside the combined report.
Registrant contact details are only returned when the call explicitly asks. Registry contact data is regulated in most jurisdictions and the safe behaviour is the default one rather than an option you have to remember to switch on.
What people build with Domain Intelligence
The jobs this data is most often used for.
endpoints
credits per call
Ops teams use Domain Intelligence to get domain registration (WHOIS) via RDAP.
Developer tools use Domain Intelligence to get dNS records over DNS-over-HTTPS.
Validation workflows use Domain Intelligence to get reverse DNS (PTR).
Data-quality teams use Domain Intelligence to get hosting / ASN / IP-owner.
What Domain Intelligence data costs
The cheapest call here is 0 credits, so $15/mo (Pro) buys 10,000 of them — $1.50 per 1,000 credits. Credits roll over and never expire, and failed or blocked calls are not charged.
Full pricing →- 1,000 free credits on signup, no card
- One key, all 184 APIs, one credit pool
- Failed and blocked calls are never charged
- Credits roll over and never expire
Call it in two lines
Sign up, get 1,000 credits and one key that works on every engine. Then this is the whole protocol.
curl -X POST https://api.reefapi.com/domain-intel/v1/whois \
-H "x-api-key: $REEF_KEY" \
-H "content-type: application/json" \
-d '{"domain":"github.com"}'import requests
r = requests.post(
"https://api.reefapi.com/domain-intel/v1/whois",
headers={"x-api-key": REEF_KEY},
json={
"domain": "github.com"
},
)
print(r.json()["data"])Have a question? We got answers.
The questions people actually ask before wiring up Domain Intelligence.
Get a free key →Why does whois on a .io domain return NOT_FOUND when the domain is clearly registered?▾
Because whois reads RDAP, and some ccTLD registries never deployed an RDAP server. A live whois on vercel.io returned ok:false, code NOT_FOUND, detail.rdap_status 404. Calling tld_detail with tld="io" explains it directly: type "ccTLD", has_rdap false, rdap_servers [], with a note that it is a legacy port-43 WHOIS TLD. Check tld_detail first for any ccTLD you have not queried before, and expect the same behavior on .de.
The availability action says a registered domain is available. Is that wrong?▾
For the TLDs above, yes, and the response admits it in the same payload. A measured availability call on vercel.io returned available true, registered false, method "rdap" and a note stating the .io caveat outright. Availability infers registration from RDAP presence, so a TLD with no RDAP server looks like an empty registry. Only trust available:true when tld_detail reports has_rdap true for that TLD. A genuinely unregistered .com looks different and says so: a made-up domain returned method "rdap-connection-closed".
What does GDPR redaction actually look like in the response?▾
Absence, not a placeholder string. Measured whois calls on reddit.com and openai.com both returned registrant: null outright, because the .com registry RDAP record carries no contact object at all - there is nothing to redact and no "REDACTED FOR PRIVACY" text to parse. Where a registry does publish a contact, an organization is kept: nic.fr returned registrant {fn "AFNIC", org "", adr, email, tel}, and it was identical with include_pii false and true, because an org is not personal data. include_pii only changes the result when the contact is a natural person.
How are MX, TXT, SOA and CAA values formatted?▾
As the full RDATA string exactly as the resolver returns it, with a ttl beside each one. Measured on github.com: MX came back as "0 github-com.mail.protection.outlook.com." with the preference number and the trailing dot both included; TXT values keep their surrounding quotes; CAA reads "0 issue \"digicert.com\""; SOA is one flat string holding all seven fields. Nothing is pre-split, so parse the MX preference off yourself. records is keyed by RR type, and meta.record_count is the total across all of them - six types on github.com summed to 41.
Why is my subdomain missing from the subdomains action?▾
Because discovery runs off Certificate Transparency logs, so a hostname appears only if it was ever covered by a publicly logged certificate. Internal names, wildcard-only hosts and anything behind a private CA will not show up. A measured stripe.com lookup returned 114 subdomains from 100 CT log rows on the fast source. Pass deep=true to search the full crt.sh history instead, which is slower and returns more.
Why is cdn empty when the site is obviously behind one?▾
cdn is populated only when the fingerprint identifies the CDN from response headers, and plenty of setups do not announce themselves there. A measured tech_detect on techcrunch.com returned cdn [] while technologies listed "Cloudflare Turnstile", "Nginx", "WordPress", "Google Tag Manager" and "reCAPTCHA", with powered_by "WordPress VIP" and generator "WordPress 6.9.7". Read technologies as well as cdn before concluding anything, and check https_available to see which scheme actually answered.
If one section of full_report fails, do I lose the whole report?▾
No. full_report merges the sections it can and reports each one's fate in meta.sections. A measured run on stripe.com with include_tech and include_hosting returned whois, dns, dnssec, ssl_certs, subdomains, tech and hosting all marked "ok" in 4.4 seconds. Inspect meta.sections before treating a missing block as an outage - on a .io domain the whois section is the one that will not make it.
Can reverse_dns take an IP instead of a domain?▾
Yes, the same parameter accepts either. Pass a domain and it resolves the A and AAAA records first, then does a PTR on each address. Pass a literal address and it PTRs just that one: 8.8.8.8 returned records [{"ip": "8.8.8.8", "ptr": "dns.google"}] with domain null, which is how you tell which mode ran. A missing PTR is one of the most common reasons outbound mail gets rejected, which is what this action is usually for.
What does the dnssec action check beyond a yes or no?▾
Three separate things, so you can tell a healthy signed zone from a broken chain. A measured cloudflare.com call returned signed true, validated_ad_flag true (the resolver cryptographically validated the answer), has_ds_record true with ds_records ["2371 13 2 32996839a6..."] showing the parent delegation is signed, has_dnskey true with dnskey_count 2, and issues []. A DS record with no matching DNSKEY is the broken-chain case, and it is flagged in issues rather than left for you to infer.
What is the Domain Intelligence API?▾
Domain Intelligence API is a ReefAPI endpoint group for domain, dns and whois lookups. It returns live JSON through POST requests under /domain-intel/v1.
Is the Domain Intelligence API free to try?▾
Yes. ReefAPI starts with 1,000 free credits, no card required. Domain Intelligence calls use the same shared credit balance as every other ReefAPI engine.
Do I need a Domain Intelligence login or account?▾
No login to Domain Intelligence is needed for the API response. You call ReefAPI with your x-api-key header, and the playground can run live examples before you create a production key.
How fresh is the Domain Intelligence data?▾
The page example is captured from a live whois call, and production requests fetch live data through ReefAPI rather than a static sample.
How many credits does the Domain Intelligence API use?▾
Domain Intelligence actions currently cost 1-3 credits per successful call. Failed or blocked calls are free, and all APIs draw from one credit pool.
19 Utilities & AI APIs on the same key
One key, one credit pool, one response envelope. If you are pulling Domain Intelligence, you are one call away from the rest of the category — no second contract, no second integration.
Need something this API does not do?
Name the endpoint, the field, or a source we do not carry yet. We ship new APIs every week and you would be first to get the key. Real people read every message and reply the same day.
Try it on your own data before you pay anything
The call above is the real endpoint, not a recording. A free key gives you 1,000 credits, the other 183 APIs, and the same envelope everywhere.
Endpoints, parameters and credit costs on this page are read from the live catalog and cannot drift from what the API accepts. Field notes were captured on 2026-08-30.