regfish
Domains, DNS, hosting and email from a single source.
Free DNS tools
Check SPF, DMARC, DNSSEC and more at dns-doctor.com
Resources & Support
Direct member of
© 2002-2026 regfish GmbH. All rights reserved.
Docs / DNS Doctor API
powered by DNS Doctor (dns-doctor.com)
DNS Doctor API
Diagnostics as an API: health checks, lookups, propagation, DKIM/DNSSEC (the same engine that powers the MCP diagnostic tools).
Base URL
https://dns-doctor.com/api/v1API v1.1.0
Authentication
Your regfish API key works here too
All endpoints work without signup (daily per-IP limit). With your existing regfish API key (as a bearer token or x-api-key header) you get a much higher quota of your own per key. It is the same key you use for the regfish API and the MCP server; DNS Doctor verifies it server-side with regfish (introspection) and never stores your secret.
Anonymous
50 requests per day and IP (for trying things out).
regfish API key
5,000 requests per day, own quota per key (bearer or x-api-key).
DNS Doctor key
For integrations without a regfish account (on request).
Some checks have additional burst brakes (e.g. mail check: 10 per 10 minutes because of the port probes; full check: 30 per minute).
Examples
First finding in 10 seconds
Full check with a regfish key (German findings)
# <dein-api-key> = kompletter regfish-Key, z. B. k7f3q9x2ab=v8n4m1c6t5z0r2w9y7e3j1
curl -H 'Authorization: Bearer <dein-api-key>' \
'https://dns-doctor.com/api/v1/check/example.de?lang=de'Raw DNS lookup
curl 'https://dns-doctor.com/api/v1/lookup/example.de/MX'Reference
Endpoints
All endpoints of the current API version. Responses are JSON; errors come structured as {error: {code, message}}. Health-check findings are localized via ?lang=de.
| Endpoint | Description |
|---|---|
GET /check/{domain} | Full DNS health check Runs 25+ checks (delegation, SOA, MX, SPF, DKIM, DMARC, MTA-STS, TLS-RPT, web records, CAA, DNSSEC) and returns a score with findings and copy-ready fixes. Parameters: domain*, lang (* required) |
GET /lookup/{name}/{type} | Raw DNS lookup via DoH Parameters: name*, type* (* required) |
GET /propagation/{name}/{type} | DNS propagation check across public resolvers Queries the same name and type on five public resolvers (cloudflare, google, alidns, dnssb, adguard) and reports whether all reachable resolvers agree on the answer set. Parameters: name*, type* (* required) |
GET /availability/{domain} | Domain availability via RDAP Non-binding availability check via public RDAP. Important: TLDs without public RDAP (for example .de) return state "unknown" together with noRdapForTld=true; only the responsible registry decides at registration time. Parameters: domain* (* required) |
GET /dkim/{domain}/{selector} | DKIM key check Fetches selector._domainkey.domain as TXT and inspects the DKIM key: key type, key length, revoked (empty p=) and testing (t=y) flags. If no DKIM record is found, found=false is returned with no further fields except status (the DNS RCODE). Parameters: domain*, selector* (* required) |
GET /dnssec/{domain} | DNSSEC chain inspection Fetches DS and DNSKEY records, computes key tags and reports which DS entries match a published DNSKEY. status is "unsigned" (no DS), "valid" (resolver-validated and at least one DS matches) or "broken". Parameters: domain* (* required) |
GET /mail-check/{domain} | Mail server check Resolves the MX hosts (forward), their reverse DNS (PTR) with FCrDNS match, and probes TCP availability of the common mail ports (SMTP, IMAP, POP3) and web ports. Only connects to public target IPs. Extra burst limit because port probes are expensive. Parameters: domain* (* required) |
GET /seo-check/{domain} | SEO & AI visibility check Fetches the page (soft-404-guarded), robots.txt and metadata, then scores how well the domain is visible to search engines and AI assistants. Findings cover indexing, content, technical and AI-crawler access. Localized (?lang=de). Extra burst limit because each run makes several outbound requests. Parameters: domain*, lang (* required) |
GET /idn/{name} | IDN/Punycode conversion Converts a domain name between Unicode and ASCII (Punycode) form, in both directions. Pure conversion, no network access and no rate limit. Parameters: name* (* required) |
POST /generate/{kind} | Generate SPF, DMARC, CAA or MTA-STS records Pure record builders, no DNS queries. Warnings and errors are returned as structured, machine-readable codes (for example "too-many-lookups"), never as display text; this is intentional so integrations can localize them. Parameters: kind* (* required) |
POST /header-analysis | Email header analysis Parses a raw email header: Received hops with time deltas, Authentication-Results (SPF/DKIM/DMARC), key sender fields and a From/Return-Path alignment hint. Body: raw header as text/plain, or JSON {"raw": "..."}. Maximum size 64 KiB. Privacy: processing is ephemeral, nothing is stored or passed on; the response is sent with Cache-Control: no-store. |
GET /badge/{domain}.svg | Embeddable DNS health badge (SVG) Parameters: domain* (* required) |
POST /mcp | MCP server (Model Context Protocol) over JSON-RPC 2.0 Stateless MCP endpoint (Streamable HTTP transport) for AI assistants. Send JSON-RPC 2.0 messages; methods: initialize, tools/list, tools/call, ping. Every check is exposed as a tool (dns_health_check, dns_lookup, dns_propagation, domain_availability, dkim_check, dnssec_check, mail_check, seo_check, idn_convert, generate_record) calling the same engine as the REST endpoints, with the same auth and rate limits. In Claude, add as a connector with URL https://dns-doctor.com/mcp. This is JSON-RPC, not REST: the schemas below are a generic JSON-RPC envelope. |
AI agents
Also available as MCP tools
The most important diagnostic endpoints (health check, mail check, DKIM, propagation, DNSSEC) are exposed as tools in the regfish MCP server: same engine, same API key, labeled "powered by DNS Doctor".
Go to the MCP documentationFull reference & web tools
Interactive documentation, all web tools and the machine-readable specification live directly at DNS Doctor.