How can we help?

DomainScan's API gives programmatic access to all 50+ tools including cryptographic hashing (MD5, SHA family, BLAKE2, RIPEMD-160) and password hashing (bcrypt, Argon2). This quickstart covers authentication, making your first call, the full endpoint reference, and code examples in JavaScript, Python, and curl.

Your DNS report in DomainScan shows all records found for a domain, grouped by type, with status indicators. Here's how to interpret every field and what to look for.

DomainScan's MCP server lets AI assistants like Claude call domain lookups, DNS queries, SSL checks, and email authentication tools directly — no copy-pasting, no switching tabs. Get connected in 5 minutes.

DomainScan's email authentication report checks your SPF, DKIM, and DMARC records in one pass, identifies misconfigurations, and explains what each finding means for your email deliverability and spoofing protection.

Email deliverability problems have a short list of common causes — bad DNS records, misconfigured authentication, blacklisting, or poor list hygiene. Work through this checklist to find and fix yours.

SPF softfail, hardfail, permerror, and DNS lookup limit errors each have a different fix. This guide walks through diagnosing each failure type and rewriting your SPF record correctly — without breaking it.

DMARC is the one record that stops your domain from being used in phishing attacks. This guide covers creating your first record, understanding the tags, reading aggregate reports, and moving from p=none to p=reject safely.

DKIM for Google Workspace is a two-step process: generate the key in Admin console, publish the TXT record at your DNS host. Google signs outbound mail once you flip the switch.

Microsoft 365 uses two CNAME records (selector1 and selector2) that point back to their infrastructure. Publish both, enable DKIM signing in Defender, verify.

DMARC for Google Workspace is not just publishing p=reject on day one. Set p=none, review 4-8 weeks of aggregate reports, fix authentication gaps, then step up.

Microsoft 365 needs a single SPF TXT record with the Exchange Online include. Ship it, verify propagation, done.

DMARC for Microsoft 365 requires SPF + DKIM to be passing first, then a phased rollout from p=none → p=quarantine → p=reject over 8-12 weeks.

Zoho Mail needs one SPF include at your domain apex. Publish it, verify, done.

Google Workspace needs one SPF TXT record at your domain apex to authorize its sending servers. Add it, verify propagation, done.

You updated your DNS record — but your site still shows the old content. DNS propagation is why. Here's how resolvers cache records, how TTL controls the wait time, and how to verify your changes have propagated globally.

A records, MX, CNAME, TXT, SOA — DNS records aren't hard once you understand the pattern. This guide decodes each type with real examples and tells you what to look for when things break.

Your domain can be blacklisted, have its SSL expire, or have DNS records changed without you knowing. This guide covers the 5 things worth monitoring continuously and how to catch problems before users do.

GoDaddy's DNS Management adds TXT records in a few clicks — but propagation is slower than modern DNS hosts.

Namecheap's Advanced DNS adds TXT records with a straightforward form. Propagation typically within 30 minutes.

Cloudflare's DNS UI adds TXT records in 4 clicks: DNS → Records → Add record → Type TXT → Save.

Nameserver changes look scary — they bypass all your existing DNS records at the old provider. Done correctly with pre-populated destination, cutover is invisible.

Route 53's Hosted Zones UI adds TXT records with proper quoting and multi-string handling for long DKIM values.

Being blacklisted on Spamhaus or Barracuda can block 80% of your email overnight. DomainScan checks 50+ blocklists simultaneously for your domain and outbound IP — here's how to read the results and take action.

A domain blacklist listing can silently kill email delivery and trigger browser warnings. This guide walks through how to check any domain against 50+ blocklists, read the results, and take action.

Scam sites look real. This guide covers 7 concrete checks — WHOIS age, SSL verification, blacklist status, and more — that separate legitimate websites from fraud in under two minutes.

Your Trust Score is a composite of 6 signal groups — blacklists, DNS, SSL, email auth, domain age, and traffic. A score below 70 usually has a fixable root cause. This guide explains each component and how to raise your score.

Subdomain takeover happens when a CNAME points to an S3 bucket, Heroku dyno, or Azure Cloud App you no longer own. Attackers re-register the resource and serve content from your subdomain. Audit monthly.

DigiCert renewals go through CertCentral. Generate a new CSR, complete Domain Control Validation, install the new cert, verify. Automate via ACME or the CertCentral API.

Let's Encrypt certs live 90 days. Renewal must be automatic — certbot, acme.sh, or CDN-managed renewals are the three modern options.

HSTS is a one-way street — set it and users' browsers remember for up to 2 years. Stage max-age carefully and audit subdomains before enabling includeSubDomains.

CSP breaks things on first deployment — every unlisted script, style, image, or font is blocked. Report-Only mode is the safety valve. Bake for a week, fix violations, then enforce.

JWTs are three base64url-encoded segments joined with dots. Anyone can decode them — no key needed. Use a decoder or split-and-decode manually.

JWT signature verification requires the correct key AND rigorous validation of alg, exp, iss, and aud. Getting any of these wrong opens the door to forgery.

Never use MD5, SHA-1, or plain SHA-256 for passwords. Argon2id is the 2026 recommendation; bcrypt is battle-tested and universally supported.