Query DNS records across multiple servers with DNSSEC checking
Lookup DNS records. Returns fresh results - perfect for shareable links.
| Parameter | Type | Description |
|---|---|---|
domains required |
string | Comma-separated list of domains to query |
type |
string | Record type (see supported types below). Default: A |
servers |
string | Comma-separated DNS server IPs or DoH hostnames. Default: 8.8.8.8, 1.1.1.1 |
# Single domain curl "/api/lookup?domains=google.com&type=A&servers=8.8.8.8" # Multiple domains curl "/api/lookup?domains=google.com,cloudflare.com&type=MX" # DNSSEC records curl "/api/lookup?domains=cloudflare.com&type=DS" # Shareable link (opens in browser) https://your-domain.com/?d=example.com&t=A&s=8.8.8.8,1.1.1.1
Lookup DNS records with full server configuration.
| Field | Type | Description |
|---|---|---|
domain required |
string | Domain name to query |
type |
string | Record type. Default: A |
servers |
array | Array of server objects: {address, name, protocol} |
curl -X POST /api/lookup \
-H "Content-Type: application/json" \
-d '{
"domain": "google.com",
"type": "A",
"servers": [
{"address": "8.8.8.8", "name": "Google", "protocol": "UDP"},
{"address": "dns.google", "name": "Google DoH", "protocol": "DoH"}
]
}'
Query authoritative nameservers directly. Finds the NS records for the domain and queries those servers, bypassing recursive resolvers and caches.
| Parameter | Type | Description |
|---|---|---|
domain required |
string | Domain name to query |
type |
string | Record type. Default: A |
{
"domain": "cloudflare.com",
"type": "A",
"authoritative": true,
"chain": {
"zone": "cloudflare.com",
"nameservers": ["ns1.cloudflare.com", "ns2.cloudflare.com"],
"nsIPs": {
"ns1.cloudflare.com": ["173.245.59.31"]
}
},
"results": [...]
}
Query authoritative nameservers directly (POST version).
| Field | Type | Description |
|---|---|---|
domain required |
string | Domain name to query |
type |
string | Record type. Default: A |
Get available DNS record types and default servers.
Health check endpoint.
{"status": "ok", "timestamp": "2026-01-17T08:00:00.000Z"}
Purchase an enterprise license via x402. Returns 402 with USDC payment requirements. After payment, returns a signed license file and binary download links.
| Parameter | Type | Description |
|---|---|---|
wallet |
string | Wallet address. If provided and has an active license, returns download links without payment. |
# Get payment requirements curl "https://dnslurp.esoup.net/api/license/purchase" # Returns 402 with x402 payment instructions ($50 USDC) # Re-download with existing license curl "https://dnslurp.esoup.net/api/license/purchase?wallet=0xYOUR_WALLET" # Returns license + download links if active
Download a platform binary. Requires the bearer token (accessToken) returned by the license purchase endpoint.
| Parameter | Type | Description |
|---|---|---|
platform required |
string | One of: darwin-arm64, darwin-x64, linux-x64, linux-arm64, windows-x64 |
Include the accessToken from your license purchase as a Bearer token.
curl -H "Authorization: Bearer YOUR_ACCESS_TOKEN" \ "https://dnslurp.esoup.net/api/license/download/darwin-arm64" -o dnslurp chmod +x dnslurp
Returns license information for the running instance. Works on both public and enterprise instances.
{
"licensed": true,
"licensee": "Acme Corp",
"product": "dnslurp",
"features": ["config", "branding", "unlimited"],
"expires": "2027-02-26"
}
{
"domain": "example.com",
"type": "A",
"timestamp": "2026-01-17T08:00:00.000Z",
"results": [
{
"server": "8.8.8.8",
"serverName": "Google",
"protocol": "UDP",
"queryTime": 12,
"authoritative": false, // AA flag - server is authoritative
"authenticated": true, // AD flag - DNSSEC validated
"truncated": false, // TC flag - response was truncated
"rcode": "NOERROR", // Response code
"records": [
{
"type": "A",
"value": "93.184.216.34",
"ttl": 300
},
{
"type": "RRSIG",
"value": "A 8 2 300 ...",
"ttl": 300,
"algorithm": 8,
"keyTag": 12345
}
]
}
]
}
| Flag | Field | Description |
|---|---|---|
| AA | authoritative |
Authoritative Answer - server is the authority for this zone |
| AD | authenticated |
Authenticated Data - DNSSEC signatures verified |
| TC | truncated |
Truncated - response was too large for UDP |
| - | rcode |
Response code: NOERROR, NXDOMAIN, SERVFAIL, REFUSED, etc. |
| Protocol | Example Server | Description |
|---|---|---|
UDP |
8.8.8.8 |
Standard DNS over UDP port 53 |
DoH |
dns.google |
DNS over HTTPS (JSON API) |
DoH servers: dns.google, cloudflare-dns.com, dns.quad9.net
| Endpoint | Limit | Window |
|---|---|---|
/api/lookup |
30 requests | 1 minute |
/api/authoritative |
15 requests | 1 minute |
| Header | Description |
|---|---|
X-RateLimit-Limit |
Maximum requests allowed per window |
X-RateLimit-Remaining |
Requests remaining in current window |
X-RateLimit-Reset |
Seconds until window resets |
When rate limited, the API returns 402 with a payment offer (see Pay-Through Access below).
The response includes the same rate limit headers as a standard 429, plus x402 payment instructions.
Clients that don't support payments can treat it like a 429 — wait for retryAfter and retry.
When rate limited, you have two options: wait for the free tier to reset, or pay for unlimited access.
// Option 1: Wait (free path — treat 402 like a 429) const res = await fetch('/api/lookup?domains=google.com&type=A'); if (res.status === 402 || res.status === 429) { const data = await res.json(); const waitSeconds = data.retryAfter || 60; console.log(`Rate limited. Retrying in ${waitSeconds}s`); await new Promise(r => setTimeout(r, waitSeconds * 1000)); // retry... } // Option 2: Pay (see Pay-Through Access section below)
DNSlurp uses the x402 protocol to offer paid access when you hit the rate limit. No signup, no API key dashboard — pay $0.01 USDC on Base and get 1 hour of unlimited access, settled in seconds.
The free tier gives you 30 requests/minute with no authentication. When you exceed the limit, the API returns 402 instead of 429. The response carries the same rate limit headers (so existing retry logic works) plus a machine-readable payment offer.
On your 31st request in a minute, you receive:
HTTP/1.1 402 Payment Required X-RateLimit-Limit: 30 X-RateLimit-Remaining: 0 X-RateLimit-Reset: 45 Retry-After: 45 Payment-Required: eyJ4NDAy... { "x402Version": 2, "error": "Rate limit exceeded.", "accepts": [{ "scheme": "exact", "network": "eip155:8453", "amount": "10000", "asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913", "description": "DNSlurp: 1-hour elevated rate limits" }], "message": "Pay $0.01 USDC to get 1 hour of unlimited access.", "retryAfter": 45 }
Free path: Wait retryAfter seconds and continue using the API at no cost.
Paid path: Sign an x402 payment and send it on your next request.
Use the @x402/fetch library to handle payment automatically.
It wraps fetch, intercepts 402 responses, signs the payment with your wallet, and retries:
// Install: npm install @x402/fetch @x402/evm import { wrapFetchWithPaymentFromConfig } from '@x402/fetch'; import { ExactEvmScheme } from '@x402/evm'; const payingFetch = wrapFetchWithPaymentFromConfig(fetch, { schemes: [{ network: 'eip155:8453', client: new ExactEvmScheme(walletAccount), }], }); // This auto-pays if rate limited const response = await payingFetch( 'https://dnslurp.esoup.net/api/lookup?domains=esoup.net&type=A' );
Or manually: include the signed payment in a Payment-Signature header.
After successful payment, the server returns:
HTTP/1.1 200 OK X-Paid-Access: granted { "message": "Payment accepted. Use this API key for 1 hour of elevated access.", "accessToken": "eyJhbGciOiJIUzI1...", "expiresAt": "2026-02-19T08:00:00.000Z", "usage": "Include as Authorization: Bearer <accessToken> in subsequent requests." }
Include the token as a Bearer token in subsequent requests. Rate limits are bypassed for 1 hour:
curl -H "Authorization: Bearer eyJhbGciOiJIUzI1..." \ "https://dnslurp.esoup.net/api/lookup?domains=esoup.net&type=A" # Response headers confirm paid status: # X-Paid-Access: active # X-Paid-Expires: 2026-02-19T08:00:00.000Z
When the token expires, you drop back to the free tier. No subscription. Pay again when you need to.
| Tier | Cost | Limits | Auth |
|---|---|---|---|
| Free | $0 | 30 req/min lookup, 15 req/min authoritative | None required |
| Paid | $0.01 USDC | Unlimited for 1 hour | Authorization: Bearer <token> |
| Field | Value |
|---|---|
| Protocol | x402 v2 |
| Network | Base (eip155:8453) |
| Currency | USDC |
| Amount | $0.01 |
| Settlement | Coinbase CDP Facilitator |
| Token Duration | 1 hour |
| Header | When | Description |
|---|---|---|
Payment-Required |
402 | Base64-encoded x402 payment requirements |
Payment-Response |
200 | Base64-encoded settlement confirmation (after payment) |
X-Paid-Access |
200 | granted (on payment) or active (using token) |
X-Paid-Expires |
200 | ISO 8601 expiry date of the access token |
Run your own DNSlurp instance with no rate limits and full configuration control. Purchase a license via x402 and receive platform binaries and a signed license file. See the license page for full details.
| Step | Request | Response |
|---|---|---|
| 1. Get pricing | GET /api/license/purchase |
402 with USDC payment requirements |
| 2. Pay via x402 | Include Payment-Signature header |
200 with signed license + download links |
| 3. Download binary | GET /api/license/download/:platform with Bearer token |
Platform binary (macOS, Linux, or Windows) |
| 4. Re-download | GET /api/license/purchase?wallet=0x... |
200 if license still active |
| Plan | Price | Duration |
|---|---|---|
| Annual | $50 USDC | 365 days |