# Domain Search URL: https://www.deepinfo.com/platform/dsi/domain-search/ ## Pivot From One Indicator to the Domains That Share It. Investigations rarely start with the answer. They start with an IP, a mail server, a registrant email or a name that looks wrong, and work outward. Domain Search filters Deepinfo’s domain index on all the layers of a domain’s record, and the finders pivot from a single indicator in one call. Each result is a full domain record, so the next pivot starts from what you just found. [Request demo](https://www.deepinfo.com/request-demo/) · [Domain Search reference](https://docs.deepinfo.com/reference/discovery/domain-search/) · [Platform guide: Domain search](https://docs.deepinfo.com/guide/dsi/domain-search/) ### Filters Go In and Domain Records Come Out. One body carries all the conditions. All `must` conditions have to match, at least one `should` condition has to match, and nothing in `must_not` may match. POST `https://api.deepinfo.com/v1/discovery/domain-search` [Reference](https://docs.deepinfo.com/reference/discovery/domain-search/) | Parameter | Type | | Description | | --- | --- | --- | --- | | `filters` | object | Optional | In the body. Conditions under `must`, `should` and `must_not`, each a field `name`, an operator `type` and a `value`. | | `sort` | array | Optional | In the body. One or more `{field, order}` pairs. | | `page` | integer | Optional | Page number, from 1. | | `page_size` | integer | Optional | Results per page. | | `export` | boolean | Optional | Export the results instead of paging through them. | | `export_format` | string | Optional | `json` or `csv`. | | `export_scope` | string | Optional | How much of each record to export: `basic`, `default` or `extended`. | Request curl: ```bash curl -X POST \ "https://api.deepinfo.com/v1/discovery/domain-search?page_size=25" \ -H "apikey: YOUR_API_KEY" \ -H "Content-Type: application/json" \ -d '{ "filters": { "must": [ { "name": "domain", "type": "eq", "value": "acme.example" } ], "should": [ { "name": "ssl.signature.is_self_signed", "type": "eq", "value": true }, { "name": "ssl.signature.is_valid", "type": "eq", "value": false } ] }, "sort": [ { "field": "ssl_last_change_date", "order": "desc" } ] }' ``` Python: ```python import requests must = [{"name": "domain", "type": "eq", "value": "acme.example"}] should = [ {"name": "ssl.signature.is_self_signed", "type": "eq", "value": True}, {"name": "ssl.signature.is_valid", "type": "eq", "value": False}, ] body = { "filters": {"must": must, "should": should}, "sort": [{"field": "ssl_last_change_date", "order": "desc"}], } r = requests.post( "https://api.deepinfo.com/v1/discovery/domain-search", params={"page_size": 25}, json=body, headers={"apikey": "YOUR_API_KEY"}, ) for record in r.json()["results"]: print(record["punycode"]) ``` JavaScript: ```javascript const url = 'https://api.deepinfo.com/v1/discovery/domain-search?page_size=25' const filters = { must: [{ name: 'domain', type: 'eq', value: 'acme.example' }], should: [ { name: 'ssl.signature.is_self_signed', type: 'eq', value: true }, { name: 'ssl.signature.is_valid', type: 'eq', value: false }, ], } const r = await fetch(url, { method: 'POST', headers: { apikey: 'YOUR_API_KEY', 'Content-Type': 'application/json', }, body: JSON.stringify({ filters, sort: [{ field: 'ssl_last_change_date', order: 'desc' }], }), }) const { results } = await r.json() results.forEach((d) => console.log(d.punycode)) ``` Response 200 OK · application/json ```json { "page": 1, "page_size": 25, "result_count": 2, "results": [ { "punycode": "staging.acme.example", "unicode": "staging.acme.example", "is_idn": false, "type": 2, "domain": { "…": "the parent domain: name, WHOIS, DNS" }, "dns": { "a": { "ip_addresses": ["203.0.113.24"] }, "…": "…" }, "ip_history": ["203.0.113.24", "198.51.100.7"], "ssl": { "issuer": { "common_name": "staging.acme.example", "…": "…" }, "signature": { "is_self_signed": true, "…": "…" }, "…": "fqdns, validity, fingerprint, extensions" }, "webdata": { "…": "…" } }, "…" ] } ``` ### Browse the Fields Family by Family. Several fields come in two forms, one for the name itself and one for its registered domain, such as `dns.a.ip_addresses` and `domain.dns.a.ip_addresses`, so a filter can target a host’s own records or its parent’s. - **Name and extension**: Name, extension and extension type, length, language, keywords, digits and hyphens, internationalized and confusable characters - **Subdomain**: Subdomain label, first and last label, nesting depth, length - **WHOIS**: Registrar, creation, update and expiry dates, registrant organization and country, name servers, status codes, privacy, past registrant emails - **DNS**: A, AAAA, NS, MX, SOA, TXT, CNAME and other record values, each with its update date, plus when DNS last changed - **IP history**: Every IP address the name, or its domain, has resolved to - **SSL**: Issuer, subject, alternative names, validity dates and length, SHA-256, SHA-1 and MD5 fingerprints, self-signed and signature flags - **Web data and HTTP**: Connection status, first and last status codes, redirect chain, final URL, security headers, cookies, page hashes Operators follow the field type: `gte` and `lte` take numbers and dates, `contains_any` and `contains_all` take array fields. The [Domain Search reference](https://docs.deepinfo.com/reference/discovery/domain-search/#ref-filtering) lists the fields under Filtering. ### Operators Match and Clauses Combine. Operators decide how one condition matches. Clauses decide how conditions combine: all of `must`, at least one `should`, none of `must_not`. Together they fit a whole investigation into one body. Every domain on one name server, registered this year, with mail servers, excluding the domains you own, is four conditions. [Search and filters guide](https://docs.deepinfo.com/getting-started/search-and-filters/) filter.json ```json { "filters": { "must": [ { "name": "dns.ns.name_servers", "type": "eq", "value": "ns1.hosting.example" }, { "name": "domain.whois.create_date", "type": "gte", "value": "2026-01-01T00:00:00Z" }, { "name": "dns.mx.mail_servers", "type": "exists", "value": true } ], "must_not": [ { "name": "domain", "type": "in", "value": ["acme.example", "acme-group.example"] } ] } } ``` 1. On one name server 2. Registered this year 3. With mail servers 4. Not a domain you own - **`eq`, `in`**: The exact value, or any of several - **`startswith`, `endswith`**: A prefix or a suffix, such as hosts that start with `login.` - **`wildcard`**: A pattern, with `?` for one character and `*` for any run - **`fuzzy`**: An approximate match, for names a few characters away from a brand - **`contains_any`, `contains_all`**: Array fields that hold any, or all, of the values - **`gte`, `lte`**: Numbers and dates, alone or as a range - **`exists`**: A field that has a value, or has none ### Each Pivot in One Call. When the question starts from a single indicator, a finder is shorter than a search. Each returns full domain records and exports like a search. | Finder | Starts from | Options | | --- | --- | --- | | [Reverse IP](https://www.deepinfo.com/data-api/apis/reverse-ip/) | An IP address | `mask` of 8, 16 or 24 widens the match to the address’s network | | [Reverse MX](https://www.deepinfo.com/data-api/apis/reverse-mx/) | A mail server | `apex` matches all mail servers under that domain | | [Reverse NS](https://www.deepinfo.com/data-api/apis/reverse-ns/) | A name server | `apex` matches all name servers under that domain | | [Reverse WHOIS Email](https://www.deepinfo.com/data-api/apis/reverse-whois-email/) | A registrant email | `apex` matches any address at the email’s domain | | [Same-Time Registered](https://www.deepinfo.com/data-api/apis/same-time-registered-domain-finder/) | A domain | Same registrant, within `interval` minutes: 1 to 60, default 5 | | [Associated Domains](https://www.deepinfo.com/data-api/apis/associated-domain-finder/) | A domain | `association` picks the shared signals: registrant email, organization or phone, name servers, IP, mail servers, SSL organization. `strict` requires all of them | | [Subdomain Finder](https://www.deepinfo.com/data-api/apis/subdomain-finder/) | A domain | All known subdomains | | [All TLDs](https://www.deepinfo.com/data-api/apis/all-tlds/) | A domain | The name under other extensions | All finders take `page`, `page_size`, `ordering` and the export parameters, and all except Subdomain Finder take `include_subdomains`. See the [Discovery reference](https://docs.deepinfo.com/reference/discovery/). ### Common Investigations Take One Request Each. Each is one Domain Search body, built from the fields above. The API sample at the top of this page is the weak-certificate search. #### Weak Certificates Under Your Domain Hosts under one domain whose certificate is self-signed or fails signature validation, most recent change first. #### Live Sites Without HSTS Sites with a `success` connection status and no `strict_transport_security` header in the response. #### Missing Clickjacking Protection Sites that answered with neither an `X-Frame-Options` header nor a Content Security Policy. #### Redirects to Another Site Names whose first response is a 301 or 302 that sends visitors to a different site. #### Look-Alikes That Take Mail `fuzzy` on `domain.name`, created since a date, `dns.mx.mail_servers` present, your domain in `must_not`. #### Confusable Internationalized Names Names where `is_idn` and `name.contains_confusable` are both true: the raw material of homoglyph lookalikes. [Domain Search examples](https://docs.deepinfo.com/reference/discovery/domain-search/#ref-examples) ### Search Sits Between Trends and Lookups. Domain Search is part of Deep Search & Insights, the query layer over Deepinfo’s own internet index. - [Domain Intelligence](https://www.deepinfo.com/platform/dsi/domain-intelligence/) (DSI): Counts of new registrations by window, TLD and name keyword. - [Instant Lookups](https://www.deepinfo.com/platform/dsi/instant-lookups/) (DSI): Check one result live: DNS, WHOIS, certificate, open ports. - [Fraudulent Domain Monitoring](https://www.deepinfo.com/platform/brp/fraudulent-domain-monitoring/) (BRP): Lookalike matching for your brands, run continuously, with evidence for takedown. ### Questions About Domain Search **When should we use a finder instead of Domain Search?** Use a finder when the question starts from one indicator, such as an IP, a mail server, a registrant email or a domain. Use Domain Search when you are describing a set of domains by several properties at once. **What is a domain record?** The unit that searches and finders return: the name and its analysis (language, keywords, internationalized and confusable flags), WHOIS with normalized and historical fields, DNS by record type, IP history, the SSL certificate and web data. [Domain Detail](https://www.deepinfo.com/data-api/apis/domain-detail/) returns the same record for a single domain. **Does Domain Search cover subdomains?** Yes. The index holds registered domains and the hostnames under them, and the `type` field tells them apart. The Subdomain family filters on the labels themselves, and `domain` returns every name under one registered domain. **How current is a domain record?** Each DNS value carries its own update date, and the record notes when DNS and the certificate last changed. For the answer as it stands right now, run an [Instant Lookup](https://www.deepinfo.com/platform/dsi/instant-lookups/) on the result. **Can we find domains registered behind a privacy service?** Yes, through every layer except the hidden registrant: DNS, certificates, IP history and web data still describe them, and WHOIS privacy is itself a searchable field. A registrant that a privacy service hides can’t be matched in a reverse WHOIS search. **Can we export the results?** Yes. Add `export=true` with `export_format` (`json` or `csv`) and `export_scope` (`basic`, `default` or `extended`) to Domain Search or to any finder. ### Bring an Indicator. We’ll Pivot It Live. Book a demo with an IP, a mail server, a registrant email or a brand name your team is watching. We run the searches and pivots with you, on the real index. [Request demo](https://www.deepinfo.com/request-demo/) [Talk to us about API access](https://www.deepinfo.com/contact/)