zonefiles.io API replacement

zonefiles.io was shut down by its owner on August 15, 2025. Scripts, blocklists and tools that still call it get no answer. NetAPI is the successor built by the founder of zonefiles.io, and this compatibility API answers the old zonefiles.io requests in the old formats, with current data. Usually one change is enough: replace https://zonefiles.io/ with https://netapi.com/zf-api/ in the URL.

https://zonefiles.io/f/compromised/domains/live/
https://netapi.com/zf-api/f/compromised/domains/live/

The compromised feeds stay free and need no account. The download and query APIs need a NetAPI API token in place of the old zonefiles.io key (old keys do not work here): sign up and copy the token from the dashboard. The regular NetAPI API is described on the API documentation page.

Endpoints

Compromised domain and IP feeds

Plain text, one domain or IP address per line, no header. live holds the entries seen in the threat feeds within the last 24 hours, full every entry ever listed. They are the same data as the compromised domains and compromised IPs lists, published under CC BY 4.0. The IP feeds contain single addresses only; network ranges are in the regular compromised IP list.

For Pi-hole, AdGuard Home and other blocklist tools, replace the old adlist URL:

https://netapi.com/zf-api/f/compromised/domains/live/

Domain download API

https://netapi.com/zf-api/a/{token}/{listType}/{zoneId}/

Add -gz to any list type for a gzip-compressed file (full-gz, update-gz, fulldata-gz, updatedata-gz). zoneId is the zonefiles.io zone id: 1 means all zones in one file, 1852 is .com (see the table below). A TLD works too, for example .../update/com/. The zone list as JSON (id, zone, type 0 = generic / 1 = ccTLD, domains_new): https://netapi.com/zf-api/a/{token}/zone_list/.

The data lists keep the zonefiles.io column order: domain, DNS servers (comma-separated), IP, IP country, country by HTML, web server, hostname, emails, a reserved field, phone numbers, Majestic rank, discovery date. Country by HTML, web server and discovery date are left empty. The regular NetAPI datasets contain more fields, among them registrar, registration and expiration dates.

# new domains of the last 24 hours, all zones, one per line
curl -s "https://netapi.com/zf-api/a/YOUR_API_TOKEN/update/1" -o new_domains.txt

# .com with data, gzip
curl -s "https://netapi.com/zf-api/a/YOUR_API_TOKEN/fulldata-gz/1852/" -o 1852.csv.gz

import requests

r = requests.get("https://netapi.com/zf-api/a/YOUR_API_TOKEN/update/1", timeout=600)
r.raise_for_status()
new_domains = r.text.splitlines()
print(len(new_domains), "domains registered in the last 24 hours")

Domain query API

https://netapi.com/zf-api/q/{token}/{domain}/ returns one domain as JSON, as on zonefiles.io:

{
    "system": {
        "status": 1,
        "description": "OK"
    },
    "data": {
        "domain": "example.com",
        "ip": "192.0.2.10",
        "dns": "ns1.example.net,ns2.example.net",
        "geo_ip": "US",
        "geo_codepage": "",
        "hostname": "",
        "emails": "",
        "phones": "",
        "technologies": {}
    }
}

system.status: 1 = OK, 2 = the domain is not in the database (answered with HTTP 200 and "data": null), 0 = error (bad token or domain name, with HTTP 400 / 401 / 403). Over the limit, the API answers HTTP 429. technologies stays empty. Limits: 100 requests a day with a free NetAPI account, 2,000 a day with Basic, 5,000 with Plus and no daily limit with Pro (paid plans have lower daily limits in the first 48 hours of an account, see request limits).

SpiderFoot: in modules/sfp_zonefiles.py replace https://zonefiles.io/q/ with https://netapi.com/zf-api/q/ and enter your NetAPI API token as the module's API key.

Zone ids

The zonefiles.io ids of all 1,432 zones with data. Zones that zonefiles.io did not have are numbered from 100,000. Id 1 is the file with all zones (381,449,221 domains).