DNS Query API — /api/v1/domain/dns

Authoritative DNS lookup over public resolvers. Pass `type=ALL` to fetch every record type in parallel. Returns TTL alongside each answer.

• Method GET
• Path /api/v1/domain/dns
• Stability STABLE
• Version v2026-05-15
• Summary Resolve A, AAAA, MX, TXT and other DNS records for a domain.

Pass these as query-string parameters (or, where indicated, in the request headers). Required params marked required.

• domain (required) — string FQDN to resolve. Wildcard prefixes (`*.foo.com`) are not supported.
• type (required) — string Comma-separated DNS record types (e.g. `A`, `MX,TXT`). Use `ALL` to query everything.
• server — string, default "Cloudflare" Which public resolver to query.

All successful responses follow the standard `{ success: true, data: {...} }` envelope. Notable fields on the data object for this endpoint:

• data[].type — string Record type for this answer block (e.g. `A`, `MX`).
• data[].result — array<object> Per-type result entries. Shape varies: A returns `{address, ttl}`, MX returns `{priority, exchange, ttl}`, etc.
• data[].time — number Resolver round-trip in ms.
• data[].host — string Queried hostname.

Truncated but representative example for a real lookup:

{
  "success": true,
  "data": [
    {
      "type": "A",
      "result": [
        {
          "address": "172.253.118.102",
          "ttl": 49
        },
        {
          "address": "172.253.118.138",
          "ttl": 49
        }
      ],
      "time": 2,
      "host": "google.com"
    }
  ]
}

Errors return HTTP status codes paired with stable machine-readable codes. Match on the code field rather than the human-readable message.

• 400 INVALID_DNS_TYPE Unrecognised record type in `type`.
• 503 RESOLVER_TIMEOUT All resolvers timed out — retry once.

Patterns we recommend when integrating this endpoint:

• Pin `server=Cloudflare` in CI to get reproducible TTLs.
• Query `type=ALL` sparingly — it issues 18 sub-queries in parallel.
• Cache results based on the smallest TTL across the answer set.

• How is this different from `dig`? Wraps the same answers in stable JSON, uses globally-distributed resolvers, and pools connections — no local DNS config required.
• Are EDNS / DNSSEC flags returned? Not yet. Use `/domain/lookup` for the signed status of the parent zone.