# dnsbin.ca

> A browser-first DNS inspection toolbox. Resolve records, compare propagation,
> check DNSSEC, reverse PTR, RDAP, mail health, and common subdomains, then save
> shareable read-only snapshots. Accounts, OAuth, and API keys are federated from
> pastebin.ca.

## How it works

- Browser panels call the same JSON REST endpoints that automation uses.
- Propagation and subdomain discovery can return JSON or Server-Sent Events
  (Accept: text/event-stream) for progressive rendering.
- Snapshots store the query metadata and result JSON as read-only public pages.

## Developer docs

- [Developer guide](https://dnsbin.ca/docs): REST API, snapshots, and authentication.
- [MCP guide](https://dnsbin.ca/docs/mcp): Model Context Protocol tools for agents.
- [OpenAPI 3.1 spec](https://dnsbin.ca/api/v1/openapi.json): the full REST contract.
- [MCP server](https://dnsbin.ca/mcp): streamable HTTP MCP endpoint.
- [Agent card](https://dnsbin.ca/.well-known/agent.json): machine-readable capabilities.
- [MCP discovery](https://dnsbin.ca/.well-known/oauth-protected-resource/mcp): protected-resource metadata.

## API summary

- GET https://dnsbin.ca/api/v1/report?domain=example.com&deep=1 — guided whole-domain diagnostic composing apex, DNSSEC, mail, and trace with plain-language findings; deep=1 also probes common subdomains (scope dns:read).
- GET https://dnsbin.ca/api/v1/lookup?name=example.com&type=A&resolver=cloudflare — DNS lookup (scope dns:read).
- GET https://dnsbin.ca/api/v1/lookup-all?name=example.com&resolver=cloudflare — resolve A/AAAA/CNAME/MX/TXT/NS/SOA/CAA in one call (scope dns:read).
- GET https://dnsbin.ca/api/v1/propagation?name=example.com&type=A — compare resolvers; also supports SSE (scope dns:read).
- GET https://dnsbin.ca/api/v1/dnssec?name=example.com — DNSSEC summary (scope dns:read).
- GET https://dnsbin.ca/api/v1/reverse?ip=1.1.1.1 — reverse PTR lookup (scope dns:read).
- GET https://dnsbin.ca/api/v1/rdap?q=example.com — RDAP lookup for domain or IP (scope dns:read).
- GET https://dnsbin.ca/api/v1/mail?domain=example.com&selectors=s1,mandrill — MX/SPF/DMARC/DKIM health; pass custom DKIM selectors via selectors (scope dns:read).
- GET https://dnsbin.ca/api/v1/discover?domain=example.com&deep=1 — subdomain discovery; guided core set by default, deep=1 probes a wider set; also supports SSE (scope dns:read).
- GET https://dnsbin.ca/api/v1/trace?name=example.com — delegation path (recursive view): NS/DS per label (scope dns:read).
- GET https://dnsbin.ca/api/v1/dnsbl?ip=1.2.3.4 — DNSBL/RBL reputation check for an IPv4 address (scope dns:read).
- POST https://dnsbin.ca/api/v1/snapshots — save {"name","type","kind","result"}; public and rate-limited (dns:create scope only when authenticating to attribute it). Anonymous snapshots expire after 30 days; account-owned ones persist until deleted.
- GET https://dnsbin.ca/api/v1/snapshots — list snapshots saved to the authenticated account (requires auth; scope dns:read).
- GET https://dnsbin.ca/api/v1/snapshots/{id} — fetch a saved snapshot (scope dns:read).
- DELETE https://dnsbin.ca/api/v1/snapshots/{id} — delete a snapshot you own (requires auth; scope dns:delete).

## Authentication

- Account API keys are minted on https://pastebin.ca and audience-bound to https://dnsbin.ca.
- Send them as: Authorization: Bearer pbca_live_…
- OAuth 2.1 + PKCE (with optional DPoP) is available for interactive MCP clients;
  pastebin.ca is the authorization server.
- Product scopes: dns:read, dns:create, dns:delete.

## Policy

- dnsbin stores saved snapshots only when explicitly requested. Anonymous snapshots are deleted after 30 days; snapshots saved to an account persist until the owner deletes them.
- DNS and RDAP queries are sent to upstream public resolvers/registries to answer the request.
- The governing family policy lives at https://pastebin.ca/privacy, https://pastebin.ca/terms, and https://pastebin.ca/abuse.