Lemon Domains
docs
lemon.domainsGet a token
Menu

Free tools API

The free tools on lemon.domains answer plain GET requests too: no account, no key, and open to any origin, so a script, an AI agent or another site's page can call them directly.

Bulk domain availability

Words in names are checked on every extension in tlds; full domains are checked as written. Up to 25 names per request.

availability
curl "https://lemon.domains/api/tools/availability?names=lemonade,getzestly.io&tlds=com,io,ai&format=md"
  • format=md returns Markdown; leave it out for JSON with a summary and one row per domain (status is available, taken, dropping or unknown, with the registrar and dates for taken names).
  • Answers come from each registry over RDAP, or WHOIS where there is no RDAP. Recent answers are shared between callers for up to 15 minutes for a free name and a day for a taken one.

Domain report and transfer check

Add .md or .json to any report or transfer page.

report
curl "https://lemon.domains/tools/domain-report/example.com.md"
curl "https://lemon.domains/tools/transfer-checker/example.com.json"

DNS, WHOIS, certificate and email checks

Every other free tool works the same way: add .md or .json to its page with the domain (or a comma-separated list, for WHOIS) as the file name, and any options as the query string.

tools
curl "https://lemon.domains/tools/dns-propagation/www.example.com.md?type=CNAME"
curl "https://lemon.domains/tools/whois-lookup/example.com,example.org.md"
curl "https://lemon.domains/tools/dns-lookup/example.com.json?type=MX"
curl "https://lemon.domains/tools/ssl-checker/example.com.md"
curl "https://lemon.domains/tools/email-checker/example.com.md"
curl "https://lemon.domains/tools/punycode/münchen.de.json"
curl "https://lemon.domains/tools/redirect-checker/example.com.md"
curl "https://lemon.domains/tools/blacklist-checker/example.com.md"
curl "https://lemon.domains/tools/is-it-down/example.com.md"
curl "https://lemon.domains/tools/port-checker/example.com.md"
curl "https://lemon.domains/tools/hosting-checker/example.com.md"
curl "https://lemon.domains/tools/dns-health/example.com.md"
curl "https://lemon.domains/tools/lookalike-domains/example.com.md"
curl "https://lemon.domains/tools/spf-checker/example.com.md"
curl "https://lemon.domains/tools/dmarc-checker/example.com.md"
curl "https://lemon.domains/tools/dkim-checker/example.com.md?selector=google"
curl "https://lemon.domains/tools/website-checker/example.com.md"
curl "https://lemon.domains/tools/subnet-calculator/10.0.0.0-22.md?split=24"
curl "https://lemon.domains/tools/subdomain-finder/example.com.md"
curl "https://lemon.domains/tools/domain-stats/org.md"
  • /tools/dns-propagation/: Whether a DNS record has reached resolvers worldwide. Options: type= (A, AAAA, CNAME, MX, NS, TXT, CAA or SOA).
  • /tools/whois-lookup/: Registration data for up to 50 domains from the registries.
  • /tools/dns-lookup/: A name's public DNS records, explained. Options: type= (one record type, such as MX, TXT or SRV; A, AAAA, CNAME, MX, TXT, NS, SOA, CAA when left out).
  • /tools/ssl-checker/: The HTTPS certificate a host serves.
  • /tools/email-checker/: MX, SPF, DMARC, DKIM, BIMI, MTA-STS and TLS-RPT checks for a domain, with a score.
  • /tools/punycode/: A domain's Unicode and punycode (ASCII) forms.
  • /tools/redirect-checker/: Every redirect from a URL or domain, the final page's headers and a security header grade.
  • /tools/blacklist-checker/: Whether a domain, its mail servers and website, or an IPv4 address are on public email blocklists, with how to get removed.
  • /tools/is-it-down/: Whether a website is down for everyone, from several locations.
  • /tools/port-checker/: Whether a domain's server is reachable on its common web and mail ports. Options: ports= (ports to check, any of 80, 443, 25, 465, 587, 993, 995, 21, 22, 53, 8080, 3306; all of them when left out).
  • /tools/hosting-checker/: Who hosts a domain's website, DNS and email, or who holds an IP address.
  • /tools/dns-health/: About 30 checks of a domain's DNS setup (nameservers, delegation and glue, SOA, DNSSEC, website and email records), each a pass, warning, problem or note with a plain fix.
  • /tools/lookalike-domains/: Lookalike domains of a domain and which are registered, with registrar, creation date, website and mail.
  • /tools/spf-checker/: A domain's SPF record explained, with DNS lookups counted through every include and mistakes flagged.
  • /tools/dmarc-checker/: A domain's DMARC record explained: the policy for failing mail, where reports go, and what to change.
  • /tools/dkim-checker/: A domain's DKIM keys, found on a selector or 30 common ones, with key size and mistakes flagged. Options: selector= (the s= value from a DKIM-Signature header, e.g. google or selector1, max 189 characters; leave out to try common selectors).
  • /tools/website-checker/: robots.txt, sitemap, share preview tags, favicon and web app manifest checks for a site, each with a fix.
  • /tools/subnet-calculator/: Network, broadcast, host range and masks for an IPv4 or IPv6 block. Options: split= (a longer prefix length to split the block into, such as 26 for a /24 split into four /26 blocks; max 3 characters).
  • /tools/subdomain-finder/: Subdomains of a domain from certificate transparency logs, with whether each still resolves.
  • /tools/domain-stats/: Domain counts per extension from the daily zone files: total, registered and dropped today and over 30 days.

Tools that read pasted text

POST the text as JSON to /api/tools/run/<tool>. Nothing you send is stored.

text tools
curl -X POST https://lemon.domains/api/tools/run/analyze_email_headers \
  -H "Content-Type: application/json" \
  -d "$(jq -Rs '{headers: .}' file.txt)"
curl -X POST https://lemon.domains/api/tools/run/decode_certificate \
  -H "Content-Type: application/json" \
  -d "$(jq -Rs '{pem: .}' file.txt)"
curl -X POST https://lemon.domains/api/tools/run/analyze_dmarc_report \
  -H "Content-Type: application/json" \
  -d "$(jq -Rs '{report: .}' file.txt)"
  • analyze_email_headers: Explain an email's raw headers: route with delays, SPF, DKIM and DMARC results and alignment, and signs of spoofing. Send {"headers": "..."}. Nothing is stored.
  • decode_certificate: Decode a certificate, chain or CSR. Send {"pem": "..."} with the PEM text.
  • analyze_dmarc_report: Explain a DMARC aggregate report: who sends as the domain, how much passes SPF, DKIM and DMARC, and what to change. Send {"report": "..."}, the XML or a .zip or .gz report as base64. Nothing is stored.

Limits

  • Availability: 500 names a day per IP address.
  • Domain reports: 10 an hour per IP address.
  • Transfer checks: 20 an hour per IP address.
  • Whether a DNS change has reached resolvers worldwide: 30 propagation checks an hour per IP address.
  • Registrar, dates and status for any domains: 10 WHOIS lookups every 10 minutes per IP address.
  • Public DNS records for any name: 60 DNS lookups every 10 minutes per IP address.
  • The HTTPS certificate a site serves: 30 certificate checks every 10 minutes per IP address.
  • Email setup checks (MX, SPF, DMARC, DKIM, BIMI, MTA-STS): 30 email checks every 10 minutes per IP address.
  • Unicode and punycode forms of a domain: 300 conversions an hour per IP address.
  • Every redirect from a URL, with headers and a security grade: 30 redirect checks an hour per IP address.
  • Whether a domain or IP address is on email blocklists: 30 blacklist checks an hour per IP address.
  • Whether a website is down for everyone or just you: 30 site checks an hour per IP address.
  • Whether a domain's server is reachable on common web and mail ports: 20 port checks an hour per IP address.
  • Who hosts a domain, or who holds an IP address: 30 hosting lookups an hour per IP address.
  • Check a domain's DNS setup for problems: 30 DNS health checks an hour per IP address.
  • Lookalike domains of yours and which are registered: 10 lookalike searches a day per IP address.
  • Check a domain's SPF record: 30 SPF checks an hour per IP address.
  • Check a domain's DMARC record: 60 DMARC checks an hour per IP address.
  • Check a domain's DKIM keys: 30 DKIM checks an hour per IP address.
  • Check robots.txt, sitemap, share previews, favicon and manifest: 30 website checks an hour per IP address.
  • Network, host range and masks for an IP block: 300 subnet calculations an hour per IP address.
  • Subdomains seen on certificates, and which still resolve: 20 subdomain searches an hour per IP address.
  • How many domains an extension has, and registrations and drops: 300 extension stats lookups an hour per IP address.
  • Explain an email's headers: route, SPF, DKIM, DMARC: 300 header checks an hour per IP address.
  • Decode a certificate, chain or CSR, and check the chain: 300 certificate decodes an hour per IP address.
  • Explain a DMARC aggregate report (.xml, .zip or .gz): 60 reports an hour per IP address.

A limited request gets a 429 with a Retry-After header. For more, use the REST API with a free account (10,000 availability checks a day), or the MCP server.

Embed the checker

To give your visitors the checker itself, paste this where you want it. It checks .com .io .ai .co .net by default; change tlds= to pick others, and add &theme=light or dark to fix the theme. Each visitor's checks count against their own limit.

embed
<iframe src="https://lemon.domains/embed/bulk-domain-availability?tlds=com,io,ai,co,net" title="Bulk domain availability checker" width="100%" height="520" style="border:0;max-width:640px" loading="lazy"></iframe>
<p style="font-size:13px"><a href="https://lemon.domains/tools/bulk-domain-availability">Bulk domain search</a> by Lemon Domains</p>

More options and a live preview are on the domain checker embed page.

Credit

If you show these results on a page, a link back is appreciated:

credit
<a href="https://lemon.domains/tools/bulk-domain-availability">Bulk domain search</a> by Lemon Domains