DNS CSV API

Agent recipe: migration audit

Audit a mail cutover with POST /api/dns/bulk. Each domain returns a zone-style inventory (MX, SPF, DMARC, and the fixed DKIM selector list, plus any hosts you add). Successful records include TTL and provenance; an invalid domain returns an ERROR row that omits them. Each fulfilled domain counts as one lookup, including a domain that returns only an ERROR row. A result with error lookup_failed does not count. Built-in DKIM probes only a static selector list (Google, Microsoft 365, and similar). Custom or per-identity selectors, including Amazon SES Easy DKIM, are not covered. A missing DKIM row is not proof that none exist. Pass known selectors in hosts as selector._domainkey. The sample hosts are outside the built-in probe list, so they add real queries.

# Migration audit: compare zone inventories before a mail cutover.
# Two domains cost two lookups (one inventory each, not one dig per record).
# relay and ses2024._domainkey are outside the built-in probe list.
# A missing DKIM row is not proof none exist; pass known selectors in hosts.
curl -X POST \
  -H "Authorization: Bearer dns_..." \
  -H "Content-Type: application/json" \
  -d '{"domains":["legacy.example.com","new.example.com"],"hosts":["relay","ses2024._domainkey"]}' \
  https://dns-csv.com/api/dns/bulk

Sample bulk response. Each domain is one inventory and one lookup.

{
  "count": 2,
  "type": "ALL",
  "results": [
    {
      "domain": "legacy.example.com",
      "records": [
        {
          "type": "MX",
          "hostname": "legacy.example.com",
          "value": "10 mail.legacy.example.com",
          "ttl": 300,
          "provenance": "configured"
        },
        {
          "type": "TXT",
          "hostname": "_dmarc.legacy.example.com",
          "value": "v=DMARC1; p=quarantine; rua=mailto:dmarc@legacy.example.com",
          "ttl": 300,
          "provenance": "configured"
        }
      ]
    },
    {
      "domain": "new.example.com",
      "records": [
        {
          "type": "MX",
          "hostname": "new.example.com",
          "value": "10 mail.new.example.com",
          "ttl": 3600,
          "provenance": "configured"
        },
        {
          "type": "A",
          "hostname": "new.example.com",
          "value": "203.0.113.10",
          "ttl": 300,
          "provenance": "resolved",
          "note": "Public A/AAAA may be synthesized from a panel ALIAS (not visible via DoH)"
        }
      ]
    }
  ],
  "meta": {
    "plan": "pro",
    "quotaUsed": 44,
    "quotaLimit": 1000
  }
}

Base URL

Authentication

All API requests require a Bearer token in the Authorization header. Generate your key from the Account page.

Endpoints

Response Format

On a successful inventory record, ttl is the time-to-live in seconds. provenance is configured when the record is published at that name, or resolved when the address may be synthesized (for example a panel ALIAS rendered as A/AAAA). note is included only when the lookup adds one. An ERROR row for an invalid domain sets isError and omits ttl and provenance.

{
  "domain": "example.com",
  "type": "ALL",
  "count": 2,
  "records": [
    {
      "type": "MX",
      "hostname": "example.com",
      "value": "10 mail.example.com",
      "ttl": 300,
      "provenance": "configured"
    },
    {
      "type": "A",
      "hostname": "example.com",
      "value": "93.184.216.34",
      "ttl": 300,
      "provenance": "resolved",
      "note": "Public A/AAAA may be synthesized from a panel ALIAS (not visible via DoH)"
    }
  ],
  "meta": {
    "plan": "pro",
    "quotaUsed": 42,
    "quotaLimit": 1000
  }
}

Plans & Quotas

Error Codes