MtrXTools API
Every MtrXTools check is available as a free JSON API: no key, no sign-up. Use it in scripts, monitoring, chat bots and internal tools. Each endpoint is a GET with query parameters, the same ones the tool pages use.
Quick start
curl 'https://www.mtrxtools.com/api/v1/dns-lookup?q=github.com&type=MX'const res = await fetch('https://www.mtrxtools.com/api/v1/dns-lookup?q=github.com&type=MX');
const body = await res.json();
if (!body.ok) throw new Error(body.error);
console.log(body.data);{
"ok": true,
"ms": 41,
"data": { ... }
}Errors return { "ok": false, "error": "..." } with an HTTP status: 400 for bad input, 403 for targets that are not allowed (private and internal addresses are never contacted), 422 when the input can't be checked, 429 when rate limited, and 502 to 504 when the target or an upstream service fails.
Rate limits and fair use
- 40 requests a minute per IP address for heavy checks: SSL/TLS, HTTP headers, website health, port check and ping. A full website health report (
section=all) counts as 8. - 60 requests a minute for everything else. IPv6 clients are counted per /64.
- Every response has
RateLimit-Limit,RateLimit-RemainingandRateLimit-Resetheaders; a 429 also hasRetry-After. - Use it for your own diagnostics and integrations. Don't use it to scan networks you don't own. Clients that cause excessive load may be blocked.
- Inputs and results are not stored. CORS is open, so browser apps on any site can call it.
Versioning
Paths start with /api/v1. Within v1 the parameters and the ok/data/error envelope stay stable; objects inside data may gain new fields, so ignore ones you don't know. Breaking changes will get a new version. The machine-readable description is at /api/v1/openapi.json (OpenAPI 3.1), and /api/v1 lists the endpoints.
Endpoints
DNS lookup
GET /api/v1/dns-lookupQuery DNS records from a public resolver or straight from the domain's authoritative nameservers, with TTLs and flags.
qrequired | Domain name. |
|---|---|
type | Record type. ALL returns the common types.Values: ALL, A, AAAA, CNAME, MX, NS, TXT, SOA, CAA, SRV, PTR, DS, DNSKEY, TLSA, NAPTR, SSHFP (default A) |
resolver | Resolver to ask, or authoritative to skip caches.Values: cloudflare, google, quad9, opendns, authoritative (default cloudflare) |
dnssec | Set to 1 to request DNSSEC records and signatures.Values: 1 |
Reverse DNS
GET /api/v1/reverse-dnsFind the PTR hostname for an IPv4 or IPv6 address and check that it resolves back to the same address.
qrequired | IPv4 or IPv6 address. |
|---|---|
resolver | Resolver to ask.Values: cloudflare, google, quad9, opendns (default cloudflare) |
SSL/TLS checker
GET /api/v1/ssl-checkerRead the certificate chain a server sends, check expiry, hostname match, trust and key, test TLS 1.0 to 1.3, and grade it.
qrequired | Hostname, URL or host:port. Implicit TLS only (no STARTTLS). |
|---|---|
port | Port, if not given in q.Default: 443 |
HTTP headers
GET /api/v1/http-headersFollow every redirect, return each hop's status, headers and timing, and grade the security headers of the final page.
qrequired | URL or hostname. |
|---|
Website health
GET /api/v1/website-healthA graded site report: DNS, every A/AAAA address, the http/https and www/apex redirect matrix, TLS, headers, domain expiry and content basics.
qrequired | Domain or URL. |
|---|---|
section | all returns every section and the overall grade in one response (counts as 8 requests against the rate limit). A single section returns just that part. Without it, only the resolved target and section list are returned.Values: all, dns, nodes, entry, tls, domain, content, edge |
SPF, DKIM & DMARC
GET /api/v1/email-authCheck SPF (with the DNS lookup count), find DKIM keys, read the DMARC policy, MTA-STS, TLS-RPT and BIMI, and grade the setup.
qrequired | Domain or email address. |
|---|---|
selectors | Extra DKIM selectors to try, comma-separated, e.g. s1,mail2026. Common ones are always tried. |
RDAP lookup
GET /api/v1/rdapRegistration data over RDAP: registrar, dates, status, nameservers and abuse contacts for a domain, IP address or range, or AS number.
qrequired | Domain, IP address, CIDR or AS number. |
|---|
WHOIS
GET /api/v1/whoisQuery WHOIS servers directly, following referrals from IANA to the registry and registrar, and return each raw response.
qrequired | Domain or IP address. |
|---|
IP info
GET /api/v1/ip-infoNetwork, AS number, approximate location, address type and reverse DNS for an IP address. Hostnames are resolved first.
qrequired | IP address or hostname. |
|---|
Cloud IP owner
GET /api/v1/cloud-ipWhich cloud, CDN or crawler owns an address, from each provider's published ranges, with service and region. Verifies Googlebot and Bingbot.
qrequired | Up to 20 IP addresses or hostnames, separated by commas or spaces. |
|---|
What's my IP
GET /api/v1/my-ipThe public IP address the request came from, with its network and approximate location.
Port check
GET /api/v1/port-checkWhether TCP ports are open, closed or filtered, with connect times and the banner a service sends first. Up to 20 ports.
qrequired | Hostname or IP address. |
|---|---|
preset | Port set to test when ports is empty.Values: common, web, mail, remote, db (default common) |
ports | Ports and ranges, comma-separated (max 20). |
Ping (TCP)
GET /api/v1/pingRound-trip time to a host from timed TCP handshakes: min, average, max, jitter and loss. Works where ICMP is blocked.
qrequired | Hostname, IP address or host:port. |
|---|---|
port | TCP port, if not given in q.Default: 443 |
count | Attempts, 1 to 10.Default: 5 |
NTP test
GET /api/v1/ntp-testQuery an NTP server over UDP 123: clock offset, delay, stratum, reference, leap status and root distance, over several samples.
qrequired | NTP server hostname or IP address. |
|---|
Error explainer
GET /api/v1/explain-errorMatch an error message or log line against MtrXTools's error library: what it means, causes, fixes, and the check that confirms it.
textrequired | Error message or log line, up to 4,000 characters. |
|---|