WhoisXML API MCP Server

Run DNS lookups for up to 200 domain names per call. Emulated bulk (no native upstream bulk endpoint): the server fans out single DNS lookups concurrently and returns a unified envelope. Each input consumes 1 credit. For larger jobs, split client-side.

Run email verification for up to 10,000 emails per call. Native bulk (uses WhoisXML's Bulk Email Verification API). Each email consumes 1 credit. Returns inline if completes within 20s, otherwise returns a job_id to poll via bulk_job_status / bulk_job_results.

Run IP geolocation lookups for up to 200 IP addresses per call. Emulated bulk (no native upstream bulk endpoint exists; the WhoisXML bulk-IP-geo product is CSV-only via web UI). The server fans out single IP geolocation lookups concurrently and returns a unified envelope. Each...

Fetch full per-input results for a completed native bulk job (created by bulk_whois or bulk_email_verification). If the job is still in-flight, returns status=running with progress; caller should retry later. Note: per-input order may differ from the original input order — the...

Check progress of an in-flight bulk job created by bulk_whois or bulk_email_verification. Returns status (running|completed) and progress counters. Use bulk_job_results once status=completed.

Discover subdomains for up to 200 domains per call. Emulated bulk (no native upstream bulk endpoint): the server fans out single subdomain lookups concurrently and returns a unified envelope. Reuses the in-memory cache of subdomain_lookup, so re-querying recently-fetched domai...

Run WHOIS lookups for up to 10,000 domains per call. Native bulk (uses WhoisXML's Bulk WHOIS API). Each domain consumes 1 credit. Returns inline if completes within 20s, otherwise returns a job_id to poll via bulk_job_status / bulk_job_results.

Classify a URL or domain into IAB content categories, website groups, and content classifications. Returns category labels with confidence scores for content filtering and brand safety.

Get historical DNS records for a domain (forward) or find domains associated with an IP (reverse).

Perform DNS record lookups for a domain. Supports A, AAAA, MX, NS, SOA, TXT, CNAME, PTR, SRV, CAA, DS, and DNSKEY record types, or "all" to retrieve every record type at once.

Find newly registered domains and subdomains containing search terms, returning registration dates. Supports wildcard (*) patterns for partial matching — without wildcards the search is exact. Multiple terms use AND logic; use separate API calls for OR logic.

Get enriched WHOIS registration information for a domain. Combines current WHOIS data with historical records to fill missing or redacted fields. Works for active and expired domains.

Verify an email address via syntax check, DNS MX lookup, and SMTP deliverability test. Also detects disposable/temporary addresses, role-based addresses (e.g. info@, noreply@), free email providers, and catch-all domains.

Look up IP netblocks by IP address, ASN, or organization name. Returns CIDR ranges, ASN number and name, organization info, and registration/update dates for each matching netblock.

Get location data for IP addresses, domains, or email addresses. Uses caller's IP if no address provided.

Find DNS records matching search criteria. Returns domains and DNS record values. Multiple search terms are combined with AND logic - results must match ALL terms. Use separate API calls for OR logic. Must use wildcards in the "term" field for partial matches otherwise the sea...

Find all domains sharing the same IP address and connection dates.

Find all services sharing the same MX server and connection dates.

Find all services sharing the same NS nameserver and connection dates.

Find domains whose WHOIS records contain specific search terms. Supports wildcard searches with * and partial string matching. Multiple terms use AND logic — domains must match ALL terms. Use separate API calls for OR logic.

Find domains using advanced field-specific search on WHOIS records. Each search term targets a specific WHOIS field (e.g., RegistrantContact.Organization, DomainName, NameServers) with optional exact match and exclude flags. Up to 4 search terms combined with AND logic.

Retrieve TLS certificate details for a domain, including issuer, validity period (not-before/not-after), subject alternative names (SANs), and chain trust status. Optionally returns the full certificate chain.

Discover all known subdomains of a domain, including first-seen and last-seen timestamps for each. Can return thousands of subdomains; use pagination to retrieve large result sets.

Check if an IoC (domain, URL, IP, CIDR, or file hash) appears in known malware, phishing, spam, or botnet databases. Returns threat classification, severity, and source feed details.

Check whether a domain is part of a known typosquatting group, or expand all domains across all groups the queried domain belongs to. Use mode="probe" for a fast triage check (returns inGroup boolean + groupId). Use mode="group" for the heavy follow-up that returns every domai...

Get WHOIS data for a domain, returning registrar name, creation/expiry/updated dates, nameservers, domain status codes, and registrant/admin/tech contact info (when not redacted). Supports both WHOIS and RDAP protocols.

Get the full timeline of WHOIS changes for a domain, showing ownership transfers, registrar changes, nameserver updates, and contact modifications over time. Supports pagination for domains with many historical records.