Domain API v2

🔨 Download domain lists and datasets directly to your server 🔨

Have general questions about our domain datasets? Read our FAQ.

Migrating from zonefiles.io? The zonefiles.io-compatible API answers the old requests in the old formats: replace zonefiles.io with netapi.com/zf-api in the URL.

Code examples in Python, Node.js, Go, PHP and cURL, plus an OpenAPI specification, are on GitHub: github.com/coderockers/netapi.

Need JSON instead of CSV, or a tool for an AI assistant? See the JSON API below and the NetAPI MCP server for Claude, ChatGPT, Cursor and other MCP clients; in ChatGPT it is also available as the NetAPI plugin.

Base endpoint: https://netapi.com/api2/ API response format: comma-separated CSV (check sample)

DOMAIN API / Get the list of supported domain zones
DOMAIN API / Domain lists and datasets: Download the full list or dataset of any domain zone, or only its new or deleted domains
DNS API / Known DNS providers: Get the list of supported DNS providers
DNS API / DNS domain lists and datasets: Download lists of domains using a particular DNS provider
WHOIS API / Known Registrars: Get the list of known domain registrars
WHOIS API / WHOIS download: Download lists of domains registered with a particular registrar
Compromised IPs and domains: Download lists of all IPs and domains associated with malicious activity
Compromised domain list: Download compromised domains for a selected domain zone
LOOKUP API / Domain Lookup API: Get information about a specific domain
LOOKUP API / IP Lookup API: Get information about a specific IP
Top 1M list: Download the NetAPI Top 1 Million most popular domains (free CSV)
JSON API / All of the above as JSON: /api-json/ for integrations and AI tools, request limits

List of existing domain zones: Get the list of supported domain zones in .CSV format

GET Request Endpoint:

https://netapi.com/api2/?method=zones

This returns a list of currently supported domain zones in .CSV format with the following fields:

Input GET parameters: ---

Output data (comma-separated .csv):

zoneTLD - zone TLD (extension), used in the download method below

isUpdatedDaily - 1 if the zone is updated daily, 0 if not

isCountryCode - 1 if the zone is a country-code (ccTLD) zone, 0 if not

* You can also download a list of all supported zones in .CSV format by clicking HERE.

Domain lists and datasets: Download the full list or dataset of any domain zone, or only its new or deleted domains

GET Request Endpoint:

https://netapi.com/api2/?method=download

Input GET parameters:

zone_tld	[Required] TLD (extension) of the required zone. To get a common dataset of all domains (all zones at once), use the all-zones parameter. For IDN zones, use the punycode form (xn--...). Example: all-zones - all domains, all zones combined com - .com zone xn--3ds443g - IDN zone ( 在线 ) ⚡ You can get the list of all supported TLDs by using the /api2/?method=zones endpoint (see above).
dataset_type	[Required] Dataset type. list - contains only a list of domains, one domain per line. dataset - contains additional data (domain, DNS servers, IP, emails, phone numbers, etc.) Read more →
filter_type	[Required] Filter. active - full list of domains of the required zone new - domains found for the last 24 hours in this zone (recently delegated) deleted - domains that were in the zone the day before and have dropped out of it (undelegated or removed by the registry in the last 24 hours). Available with `dataset_type=list` only; a request with `dataset_type=dataset` returns 405. ⚡ A deleted domain is not necessarily free to register: the name has dropped out of the zone because its registration expired or it was suspended or undelegated. After the expiration date a domain normally goes through a renewal grace period and a redemption period (typically 30 to 75 days depending on the zone) during which the holder can still restore it, and only then a short pending-delete period before it is released. Names that get renewed or unsuspended return to the zone and show up in the new list again. Check the actual status with a WHOIS/RDAP lookup (for example the `lookup-domain` method) before relying on it. ⚡ The new filter is available only for daily-updated zones (`isUpdatedDaily=1` in the `zones` method). For the other zones (full refresh every month), only the active filter is available. The deleted filter is available for the daily-updated zones whose registry publishes the complete zone every day (all gTLDs, .ru/.su/.рф and the ccTLDs whose registry publishes its full list, such as .ch/.sk/.ee); other zones return 405. Read more →
token	[Required] API access token. This is your unique API token that can be found in the Dashboard.
format	[Optional] The format of the response file. By default, you will receive the dataset in the compressed .GZ format. If you require plain-text format, you can add the &format=plain parameter to your request. ⚡ Warning: Plain-text files tend to be very large (for example, the .COM zone file size can be up to several gigabytes). Use this parameter only if necessary.

Output data (comma-separated .csv):

Domain - domain name

Majestic rank - Majestic rank, integer (empty if not ranked)

DNS 1 - DNS server 1

DNS 2 - DNS server 2

Hostname - remote server hostname

Emails - emails collected from the website (one field, comma-separated)

Phones - phone numbers collected from the website (one field, comma-separated)

Server IP - remote server IP

Domain country - the two-letter country code of the website domain, determined by server IP (geolocation)

Registered at - domain registration date (YYYY-MM-DD), where the registry publishes it

Expiring at - domain expiration date (YYYY-MM-DD), where the registry publishes it

Registrar - sponsoring registrar (name), where the registry publishes it

WHOIS checked at - date of the latest WHOIS/RDAP check of the registration data (YYYY-MM-DD)

Response and Error Codes

Our List/Dataset Download API returns one of the following HTTP response codes:

Code	Description
200	OK
401	401 Unauthorized: Missing user token.
403	403 Forbidden: Incorrect token.
403	403 Forbidden: Payment under review. Access is enabled after a manual check (usually 2-6 hours).
405	405 Method Not Allowed: Missing zone type.
405	405 Method Not Allowed: Invalid zone tld.
405	405 Method Not Allowed: Missing dataset type.
405	405 Method Not Allowed: Invalid dataset type.
405	405 Method Not Allowed: Missing filter type.
405	405 Method Not Allowed: Invalid filter type.
405	405 Method Not Allowed: Deleted domains are available as lists only (dataset_type=list).
405	405 Method Not Allowed: Deleted lists are available only for zones whose registry publishes the complete zone daily.
429	429 Too Many Requests: limit of N requests per minute / per day for this method group (Retry-After header, see request limits).
403	403 Forbidden: No active/paid plan.
403	403 Forbidden: Your current plan does not allow downloading of detailed datasets.
404	404 Not Found: No deleted-domains list is available for this zone today.
404	404 Not Found: File not found. Please contact the server administrator.

Get the list of supported DNS providers

GET Request Endpoint:

https://netapi.com/api2/?method=dns

This returns a list of currently supported DNS providers with the following fields:

Input GET parameters: ---

Output data (comma-separated .csv):

alias - DNS provider alias (used in download-dns method)

title - DNS provider name

total - known domains for this provider

* You can also download the list of all supported DNS providers by clicking HERE.

DNS domain lists and datasets: Download lists of domains using a particular DNS provider

GET Request Endpoint:

https://netapi.com/api2/?method=download-dns

Input GET parameters:

dns_alias	[Required] Alias of the required DNS provider. Use the `dns` method listed above to get the full list of aliases for all currently supported DNS providers (or download them here).
dataset_type	[Required] Dataset type. list - contains only a list of domains, one domain per line dataset - contains additional data (domain, DNS servers, IP, emails, phone numbers, etc.) Read more →
token	[Required] API access token. This is your unique API token that can be found in the Dashboard.
format	[Optional] The format of the response file. By default, you will receive the dataset in the compressed .GZ format. If you require plain-text format, you can add the &format=plain parameter to your request. ⚡ Warning: Plain-text files tend to be very large (for example, the Cloudflare domain dataset can be up to several gigabytes). Use this parameter only if necessary.

Output data (comma-separated .csv):

Domain - domain name

Majestic rank - Majestic rank, integer (empty if not ranked)

DNS 1 - DNS server 1

DNS 2 - DNS server 2

Hostname - remote server hostname

Emails - emails collected from the website (one field, comma-separated)

Phones - phone numbers collected from the website (one field, comma-separated)

Server IP - remote server IP

Domain country - the two-letter country code of the website domain, determined by the server IP (geolocation)

Response and Error Codes

Our List/Dataset Download API returns one of the following HTTP response codes:

Code	Description
200	OK
401	401 Unauthorized: Missing user token.
403	403 Forbidden: Incorrect token.
403	403 Forbidden: Payment under review. Access is enabled after a manual check (usually 2-6 hours).
405	405 Method Not Allowed: Missing DNS alias.
405	405 Method Not Allowed: Invalid DNS alias.
405	405 Method Not Allowed: Missing dataset type.
405	405 Method Not Allowed: Invalid dataset type.
429	429 Too Many Requests: limit of N requests per minute / per day for this method group (Retry-After header, see request limits).
403	403 Forbidden: No active/paid plan.
403	403 Forbidden: Your current plan does not allow downloading of detailed datasets.
404	404 Not Found: File not found. Please contact the server administrator.

Known Domain Registrars: Get the list of supported registrars

GET Request Endpoint:

https://netapi.com/api2/?method=registrars

This returns a list of currently known domain registrars with the following fields:

Input GET parameters: ---

Output data (comma-separated .csv):

id - Registrar ID (used in the download-whois method)

name - official name (legal entity, e.g. 'Tucows Domains Inc.')

brand_name - known brand name (e.g. 'GoDaddy', 'Namecheap')

total - known domains for this registrar

* You can also download a list of all known registrars by clicking HERE.

WHOIS lists and datasets: Download lists and datasets of domains registered with a particular registrar

GET Request Endpoint:

https://netapi.com/api2/?method=download-whois

Input GET parameters:

registrar_id	[Required] ID of the required registrar. Use the `registrars` method listed above to get the IDs of all known registrars (or download them here).
dataset_type	[Required] Dataset type. list - contains only a list of domains, one domain per line dataset - contains additional data (domain, registration date, expiration date, server IP, country code, emails, phone numbers, etc.) Read more →
token	[Required] API access token. This is your unique API token that can be found in the Dashboard.
format	[Optional] The format of the response file. By default, you will receive the dataset in the compressed .GZ format. If you require plain-text format, you can add the &format=plain parameter to your request. ⚡ Warning: Plain-text files tend to be very large (for example, the GoDaddy domain dataset can be up to several gigabytes). Use this parameter only if necessary.

Output data (comma-separated .csv):

Registrar - registrar name

Domain - domain name

Registration date - domain registration date

Expiration date - domain expiration date

Majestic rank - Majestic rank, integer (empty if not ranked)

Emails - emails collected from the website (one field, comma-separated)

Phones - phone numbers collected from the website (one field, comma-separated)

Server IP - remote server IP

Domain country - two-letter country code of the website domain, determined by the server IP (geolocation)

Response and Error Codes

Our List/Dataset Download API returns one of the following HTTP response codes:

Code	Description
200	OK
401	401 Unauthorized: Missing user token.
403	403 Forbidden: Incorrect token.
403	403 Forbidden: Payment under review. Access is enabled after a manual check (usually 2-6 hours).
405	405 Method Not Allowed: Missing Registrar ID.
405	405 Method Not Allowed: Invalid Registrar ID.
405	405 Method Not Allowed: Missing dataset type.
405	405 Method Not Allowed: Invalid dataset type.
429	429 Too Many Requests: limit of N requests per minute / per day for this method group (Retry-After header, see request limits).
403	403 Forbidden: No active/paid plan.
403	403 Forbidden: Your current plan does not allow downloading of detailed datasets.
404	404 Not Found: File not found. Please contact the server administrator.

Domain Lookup API: Get information about a specific domain

GET Request Endpoint:

https://netapi.com/api2/?method=lookup-domain

Returns data for the specified domain in .CSV format:

Input GET parameters:

domain

[Required] Domain name (for example, domain.com)

token

[Required] API access token.

This is your unique API token that can be found in the Dashboard. An active paid plan (any plan) is required.

Output data (comma-separated .csv):

URL - requested domain

DNS1 - DNS server 1

DNS2 - DNS server 2

HOSTNAME - server hostname

IP - server IP

COUNTRY_CODE - two-letter country code (according to the server IP)

REGISTERED_AT - domain registration date (YYYY-MM-DD)

EXPIRING_AT - domain expiration date (YYYY-MM-DD)

REGISTRAR_ID - registrar ID (integer, see the registrars method)

WHOIS_CHECKED_AT - date of the latest WHOIS/RDAP check of the registration data (YYYY-MM-DD)

Response and Error Codes

Our Domain Lookup API returns one of the following HTTP response codes:

Code	Description
200	OK
401	401 Unauthorized: Missing user token.
403	403 Forbidden: Incorrect token.
403	403 Forbidden: Payment under review. Access is enabled after a manual check (usually 2-6 hours).
429	429 Too Many Requests: limit of N requests per minute / per day for this method group (Retry-After header, see request limits).
403	403 Forbidden: No active/paid plan.
405	405 Method Not Allowed: Missing domain name.
405	405 Method Not Allowed: Invalid domain zone.
405	405 Method Not Allowed: Domain name is too long.

IP Lookup API: Get information about a specific IP

GET Request Format:

https://netapi.com/api2/?method=lookup-ip

Returns domains hosted on the specified IP in .CSV format (one domain per line, up to 3 results):

Input GET parameters:

[Required] IP (for example, 172.67.69.160)

token

[Required] API access token.

Your unique API token that can be found in the Dashboard. An active paid plan (any plan) is required.

Output data (comma-separated .csv):

DOMAIN - domain hosted on the given IP

HOSTNAME - server hostname of that domain

DNS1 - DNS server 1 of that domain

DNS2 - DNS server 2 of that domain

Response and Error Codes

Our IP Lookup API returns one of the following HTTP response codes:

Code	Description
200	OK
401	401 Unauthorized: Missing user token.
403	403 Forbidden: Incorrect token.
403	403 Forbidden: Payment under review. Access is enabled after a manual check (usually 2-6 hours).
429	429 Too Many Requests: limit of N requests per minute / per day for this method group (Retry-After header, see request limits).
403	403 Forbidden: No active/paid plan.
405	405 Method Not Allowed: Missing IP.
405	405 Method Not Allowed: IP address is too long.

🆓 Compromised IPs and domains: Download all compromised IPs or domain names

GET Request Format:

https://netapi.com/api2/?method=compromised

This returns a list of compromised IPs or domain names:

Input GET parameters:

dataset_type

[Required] Dataset type.

ip - current compromised IP addresses (seen in the last 24 hours)

url - current compromised domain names (seen in the last 24 hours)

ip-all - historical list of IPs ever compromised.
⚠️ The presence of an IP in this list does not mean that the IP is compromised at the moment (most likely it is not).

url-all - historical list of domain names ever compromised.
⚠️ The presence of a domain in this list does not mean that the domain is compromised at the moment (most likely it is not).

Output data:

IP or Domain - one per line

🆓 Compromised domain list: Download compromised domains for a selected TLD

GET Request Format (single zone, live domains only):

https://netapi.com/api2/?method=compromised-zone

Returns a list of currently compromised domains for one domain zone (TLD) only.
Only entries seen in the last 24 hours are included. IP addresses are not included in this export.

Input GET parameters:

zone_tld

[Required] TLD (extension) of the required zone.

Example:

com — .com zone

net — .net zone

⚡ You can get the list of all supported TLDs by using the /api2/?method=zones endpoint (see above).

Output data:

Domain — one per line (CSV download, filename e.g. compromised_com.csv)

🆓 Top 1M list: Download the NetAPI Top 1 Million most popular domains

Free daily CSV ranking of the one million most popular domains on the Internet (Alexa Top 1 Million-style replacement). No API token or registration required. Details and methodology: /top-1-mln-websites/.

GET Request Format:

https://netapi.com/netapi_top1mln.csv

Input GET parameters:

—	None required.

Output data (comma-separated .csv):

NetAPI_Rank - integer rank from 1 to 1,000,000 (1 = most popular)

Domain - domain name without subdomain (e.g. google.com)

Rows are ordered by ascending rank (most popular first). The first line is the header: NetAPI_Rank,Domain. The file is regenerated daily.

Example:

NetAPI_Rank,Domain
1,google.com
2,facebook.com
3,youtube.com

JSON API: the same data as JSON documents

Base endpoint: https://netapi.com/api-json/?method=...

Built for AI tools and integrations: every answer is a JSON document, errors are {"error": {"code": "...", "message": "..."}} with the matching HTTP status. The token goes into the Authorization: Bearer YOUR_API_TOKEN header (the ?token= parameter works too). The method can also be part of the path: /api-json/tld-stats/?tld=de is the same call (one path per method, as OpenAPI-driven tools such as GPT Actions need it). The NetAPI MCP server for AI assistants is a thin layer over these methods (in ChatGPT: the NetAPI plugin).

Free methods (no token; a token raises the limits)

method	parameters	answer
`compromised-check`	`value` = domain or IP	listed_now (seen in the last 24 h), listed_ever, first / last seen, block reason, registrar; parent domains of a host name are tried too
`search-new`	`q` (4+ characters), `days` 1-7, `tld`, `match` = contains \| starts, `limit`	newly registered domains containing the text, newest first
`tld-stats`	`tld`	registry, active / new / deleted domains, growth over 7-365 days, rank, abuse figures, Top 1M presence, policies, description
`domain-rank`	`domain`	NetAPI Top 1M rank and rank inside the TLD
`top-websites`	`country` (name or two-letter code), `limit`, `offset` (offset + limit ≤ 1,000)	the 1,000 websites users in a country visit most, on any domain zone (`rank` in the country, `global_rank` in the Top 1M)
`top-1m`	`limit`, `offset`	slice of the Top 1M
`registrar-info`	`q` = name, brand or id	domains, rank by size, abuse rate, page
`dns-provider-info`	`q` = alias, name or nameserver root	domains, market share and its change, page
`zones`	`min_domains`, `cctld` = 1 \| 0	every zone with active / new / deleted domains
`me`	token required	account, plan, limits

Methods that need an active plan (token required)

method	parameters	answer
`lookup-domain`	`domain`	JSON twin of lookup-domain: dns[], hostname, ip, ip_country, registered_on, expires_on, registrar, whois_checked_on
`lookup-ip`	`ip`	JSON twin of lookup-ip: up to 3 domains with hostname and dns[]
`download-url`	one of `zone_tld` (or `all-zones`), `dns_alias`, `registrar_id`; `dataset_type` = list \| dataset, `filter_type` (zones: active \| new \| deleted, default active), `format` = gz \| plain	a temporary link (24 hours) to the file instead of the file itself: the domains of a zone, of a DNS provider or of a registrar; same rules as download, download-dns and download-whois (lists with any plan, datasets need Plus or Pro)

⚡ Example: https://netapi.com/api-json/?method=compromised-check&value=example.com — the error codes are missing_parameter, invalid_*, not_found, missing_token (401), invalid_token (403 or 401), no_plan / plan_too_low (403), rate_limited (429, with retry_after and the Retry-After header).

Request limits

All API entry points share the same limits, counted per account (per IP address without a token) and reset at 00:00 UTC. When a limit is reached the API answers 429 Too Many Requests with a Retry-After header.

Access	Free JSON methods	List methods	search-new	Lookups	Downloads
No token	30 / min, 1,000 / day	10 / min, 200 / day	6 / min, 100 / day, 100 rows	—	—
Token, no plan	60 / min, 5,000 / day	30 / min, 1,000 / day	30 / min, 500 / day, 500 rows	—	—
Basic	60 / min	60 / min	2,000 / day, 1,000 rows	2,000 / day	300 / day
Plus	60 / min	60 / min	5,000 / day, 5,000 rows	5,000 / day	1,000 / day
Pro	120 / min	120 / min	no daily limit	no daily limit	no daily limit

Downloads = download, download-dns, download-whois, download-url (all entry points together); lookups = lookup-domain and lookup-ip. Accounts younger than 48 hours have lower daily caps.