DNS 安全分析 API 参考

请求示例

curl -H "X-API-Key: $DOMSCAN_API_KEY" "https://domscan.net/v1/dns/security?domain=example.com"

const response = await fetch("https://domscan.net/v1/dns/security?domain=example.com", {
  headers: { "X-API-Key": process.env.DOMSCAN_API_KEY },
});
const data = await response.json();
console.log(data);

import os
import requests

response = requests.get(
    "https://domscan.net/v1/dns/security?domain=example.com",
    headers={"X-API-Key": os.environ["DOMSCAN_API_KEY"]},
)
print(response.json())

package main

import (
	"fmt"
	"io"
	"net/http"
	"os"
)

func main() {
	req, err := http.NewRequest(http.MethodGet, "https://domscan.net/v1/dns/security?domain=example.com", nil)
	if err != nil {
		panic(err)
	}
	req.Header.Set("X-API-Key", os.Getenv("DOMSCAN_API_KEY"))

	resp, err := http.DefaultClient.Do(req)
	if err != nil {
		panic(err)
	}
	defer resp.Body.Close()

	data, err := io.ReadAll(resp.Body)
	if err != nil {
		panic(err)
	}
	fmt.Println(resp.Status, string(data))
}

require "json"
require "net/http"

uri = URI("https://domscan.net/v1/dns/security?domain=example.com")
request = Net::HTTP::Get.new(uri)
request["X-API-Key"] = ENV.fetch("DOMSCAN_API_KEY")

response = Net::HTTP.start(uri.hostname, uri.port, use_ssl: true) do |http|
  http.request(request)
end
puts JSON.pretty_generate(JSON.parse(response.body))

响应示例

{
  "domain": "google.com",
  "security_score": 97,
  "security_grade": "A+",
  "spf": {
    "exists": true,
    "record": "v=spf1 include:_spf.google.com ~all",
    "valid": true,
    "policy": "softfail",
    "includes": [
      "_spf.google.com"
    ],
    "dns_lookup_count": 1,
    "dns_lookup_limit_exceeded": false,
    "include_tree": [
      {
        "domain": "_spf.google.com",
        "lookups": 1
      }
    ],
    "lookup_walk_count": 1,
    "macros_present": false,
    "macro_references": [],
    "walk": [
      {
        "domain": "google.com",
        "depth": 0,
        "record": "v=spf1 include:_spf.google.com ~all",
        "mechanisms": [
          "include:_spf.google.com",
          "~all"
        ],
        "includes": [
          "_spf.google.com"
        ],
        "redirect": null,
        "direct_lookup_count": 1,
        "total_lookup_count": 1,
        "macros_present": false,
        "macro_references": [],
        "multiple_records": 1
      }
    ],
    "walk_errors": [],
    "issues": []
  },
  "dkim": {
    "exists": true,
    "selectors_checked": [
      "google",
      "selector1",
      "selector2"
    ],
    "selectors_found": [
      "google"
    ],
    "valid": true
  },
  "dmarc": {
    "exists": true,
    "record": "v=DMARC1; p=reject; rua=mailto:[email protected]",
    "valid": true,
    "policy": "reject",
    "subdomain_policy": "reject",
    "percentage": 100,
    "rua": [
      "mailto:[email protected]"
    ],
    "ruf": [],
    "issues": []
  },
  "bimi": {
    "exists": true,
    "record": "v=BIMI1; l=https://example.com/logo.svg; a=https://example.com/vmc.pem",
    "logo_url": "https://example.com/logo.svg",
    "authority_url": "https://example.com/vmc.pem",
    "valid": true,
    "logo_fetch_ok": true,
    "logo_http_status": 200,
    "logo_content_type": "image/svg+xml",
    "logo_bytes": 2048,
    "logo_svg_detected": true,
    "vmc_present": true,
    "vmc_fetched": true,
    "vmc_http_status": 200,
    "vmc_content_type": "application/x-pem-file",
    "vmc_certificate_valid": true,
    "vmc_subject": "/CN=Example Inc VMC",
    "vmc_issuer": "/CN=Example Issuer",
    "vmc_not_before": "2026-01-01T00:00:00Z",
    "vmc_not_after": "2027-01-01T00:00:00Z",
    "vmc_days_to_expiry": 258,
    "vmc_fingerprint_sha256": "AA:BB:CC:DD",
    "vmc_san_domains": [
      "google.com"
    ],
    "errors": []
  },
  "dnssec": {
    "enabled": true,
    "valid": true,
    "algorithm": "ECDSAP256SHA256",
    "key_tag": 12345,
    "validation_status": "secure",
    "validated_by_proxy": true,
    "validation_reason": "chain validated via delv",
    "ds_records": [
      "12345 13 2 1a2b3c4d5e6f"
    ],
    "dnskey_records": [
      "256 3 13 AbCdEfGhIjKlMnOp"
    ],
    "rrsig_present": true,
    "resolver": "127.0.0.1",
    "mismatch_detail": {
      "checked": true,
      "mismatch_detected": false,
      "reason": "chain validated via delv",
      "ds_record_count": 1,
      "dnskey_record_count": 1,
      "rrsig_present": true,
      "validation_status": "secure",
      "resolver": "127.0.0.1"
    }
  },
  "caa": {
    "exists": true,
    "records": [
      {
        "flags": 0,
        "tag": "issue",
        "value": "pki.goog"
      }
    ],
    "issuers": [
      "pki.goog"
    ],
    "issue_wild": [],
    "iodef": "mailto:[email protected]"
  },
  "issuance_readiness": {
    "caa": {
      "exists": true,
      "records": [
        {
          "flags": 0,
          "tag": "issue",
          "value": "pki.goog"
        },
        {
          "flags": 0,
          "tag": "iodef",
          "value": "mailto:[email protected]"
        }
      ],
      "issue_issuers": [
        "pki.goog"
      ],
      "issuewild_issuers": [],
      "iodef": "mailto:[email protected]",
      "letsencrypt_allowed": false,
      "google_trust_services_allowed": true
    },
    "http01": {
      "challenge_path": "/.well-known/acme-challenge/domscan-probe-1713474000",
      "reachable": true,
      "ready": true,
      "status_code": 404,
      "final_url": "http://google.com/.well-known/acme-challenge/domscan-probe-1713474000",
      "redirects": 0,
      "error": null
    },
    "checked_at": "2026-04-18T21:00:00Z"
  },
  "authoritative_consistency": {
    "record_type": "SOA",
    "all_authoritative": true,
    "answer_sets_match": true,
    "inconsistent_nameservers": [],
    "consistent_serial": true,
    "serials": [
      {
        "host": "ns1.google.com",
        "udp_soa_serial": "2026041801",
        "tcp_soa_serial": "2026041801"
      }
    ],
    "reference_answers": [
      "google.com. 60 IN SOA ns1.google.com. dns-admin.google.com. 2026041801 900 900 1800 60"
    ]
  },
  "delegation_health": {
    "nameservers": [
      {
        "host": "ns1.google.com",
        "addresses": [
          "216.239.32.10"
        ],
        "in_bailiwick": false,
        "glue_required": false,
        "udp": {
          "authoritative": true,
          "status": "NOERROR",
          "query_ms": 14,
          "answer_count": 1,
          "answers": [
            "google.com. 60 IN SOA ns1.google.com. dns-admin.google.com. 2026041801 900 900 1800 60"
          ],
          "soa_serial": "2026041801",
          "truncated": false,
          "error": null
        },
        "tcp": {
          "authoritative": true,
          "status": "NOERROR",
          "query_ms": 18,
          "answer_count": 1,
          "answers": [
            "google.com. 60 IN SOA ns1.google.com. dns-admin.google.com. 2026041801 900 900 1800 60"
          ],
          "soa_serial": "2026041801",
          "truncated": false,
          "error": null
        },
        "lame": false,
        "issues": []
      }
    ],
    "in_bailiwick_nameservers": [],
    "glue_required_count": 0,
    "all_in_bailiwick_resolve": true,
    "missing_addresses": [],
    "lame_nameservers": []
  },
  "dns_transport": {
    "udp_working": true,
    "tcp_working": true,
    "tcp_supported_nameservers": [
      "ns1.google.com"
    ],
    "tcp_failed_nameservers": [],
    "truncation_tested": true,
    "truncation_nameserver": "ns1.google.com",
    "truncation_record_type": "DNSKEY",
    "truncation_observed": false,
    "tcp_fallback_ready": null
  },
  "nameserver_drift": {
    "checked": true,
    "drift_detected": false,
    "public_nameservers": [
      "ns1.google.com"
    ],
    "authoritative_nameservers": [
      "ns1.google.com"
    ],
    "missing_from_authority": [],
    "extra_at_authority": [],
    "inconsistent_nameservers": [],
    "serial_mismatch_detected": false
  },
  "mta_sts": {
    "exists": true,
    "record": "v=STSv1; id=2024010101Z",
    "valid": true,
    "policy_id": "2024010101Z",
    "policy_fetch_ok": true,
    "policy_http_status": 200,
    "mode": "enforce",
    "max_age": 86400,
    "mx_hosts": [
      "*.google.com"
    ],
    "mx_records": [
      "aspmx.l.google.com",
      "alt1.aspmx.l.google.com"
    ],
    "policy_matches_mx": true,
    "uncovered_mx": [],
    "errors": []
  },
  "tls_rpt": {
    "exists": true,
    "record": "v=TLSRPTv1; rua=mailto:[email protected]",
    "valid": true,
    "rua": [
      "mailto:[email protected]"
    ],
    "errors": []
  },
  "resolver_latency": {
    "record_type": "MX",
    "resolvers": [
      {
        "resolver": "1.1.1.1",
        "label": "Cloudflare",
        "query_ms": 22,
        "status": "NOERROR",
        "answer_count": 5,
        "answers": [
          "aspmx.l.google.com"
        ],
        "server": "1.1.1.1#53",
        "error": null
      },
      {
        "resolver": "8.8.8.8",
        "label": "Google Public DNS",
        "query_ms": 3,
        "status": "NOERROR",
        "answer_count": 5,
        "answers": [
          "aspmx.l.google.com"
        ],
        "server": "8.8.8.8#53",
        "error": null
      }
    ],
    "min_ms": 3,
    "max_ms": 22,
    "avg_ms": 12.5
  },
  "zone_transfer": {
    "exposed": false,
    "nameservers": [
      {
        "host": "ns1.google.com",
        "exposed": false,
        "query_ms": 18,
        "records_returned": 0,
        "soa_seen": false,
        "reason": "transfer failed",
        "sample_records": []
      }
    ]
  },
  "blacklist": {
    "domain": "google.com",
    "listed": false,
    "threat_level": "none",
    "check_type": "domain",
    "checked_at": "2026-04-18T21:00:00Z"
  },
  "edge_summary": {
    "relay_configured": true,
    "evidence_sources": [
      "dnssec_validate",
      "axfr_check",
      "dns_authority_health",
      "dns_latency",
      "issuance_readiness",
      "mail_policies",
      "bimi_audit",
      "spf_walk"
    ],
    "secure_dns_chain": true,
    "zone_transfer_exposed": false,
    "authoritative_consistency_ok": true,
    "nameserver_drift_detected": false,
    "lame_nameserver_count": 0,
    "tcp_fallback_ready": null,
    "avg_resolver_latency_ms": 12.5,
    "fastest_resolver": "Google Public DNS",
    "slowest_resolver": "Cloudflare",
    "issuance_http01_ready": true,
    "caa_restricts_issuers": true,
    "bimi_vmc_valid": true,
    "mta_sts_enforced": true,
    "tls_rpt_configured": true,
    "spf_lookup_limit_exceeded": false
  },
  "recommendations": [],
  "checked_at": "2026-04-18T21:00:00Z",
  "check_duration_ms": 312
}

HTTP 状态码

• 200 成功
• 400 请求错误
• 401 未授权
• 402 需要付款
• 429 请求过多