domains
GET /v1/domains/{domainId}/delegation
Whether a domain's delegation actually points at us.
Authentication
Send an API key as a bearer token. The key must carry the sites.view permission; a key without it is refused with 403, not 404.
This endpoint takes no organisation id. Your key already identifies the organisation it belongs to, and the response is scoped to it.
Try it
Replace anything in angle brackets with your own values, and the key placeholder with a key from your dashboard.
curl -X GET https://api.zinndigital.com/v1/domains/{domainId}/delegation \
-H "Authorization: Bearer zdk_live_…"Signed in? The API console in your dashboard fills in your real organisation id and your own key, and runs the request against the live API so you can see the actual response. Open this endpoint in the API console
Details
The honest answer to "is my domain live yet?". expected is the delegation we ask the customer to set, nameservers is where the domain actually delegates right now, and detected says whether those agree. ⛔ detected is resolved from a public recursive resolver, not from the DNS vendor. Bunny's own NameserversDetected flag was measured returning true for a domain that is not registered at all, so a surface keyed off it tells a customer their domain is served before they have touched their registrar (docs/72 D243). A lookup that FAILED is a 503, never detected: false: "not live yet" and "we could not check" lead a customer to opposite actions. A domain whose authoritative DNS we do not host is a 404. Requires sites.view, RLS-scoped. The answer is recorded, not recomputed per request, so this read is cheap enough to poll — a background backoff poller keeps it fresh (see POST). A live lookup that fails on a domain last seen delegated leaves the recorded state alone, so the 503 now means we have never established this domain's delegation rather than this one lookup failed.
Parameters
| Name | Type | Required | What it is |
|---|---|---|---|
domainId (path) | Uuid | Yes | The domain's id. |
Response
| Name | Type | Required | What it is |
|---|---|---|---|
expected | string[] | Yes | The delegation we ask the customer to set at their registrar. Resolved per domain, from the zone's own nameservers where the provider assigns them — Cloudflare issues each… |
nameservers | string[] | Yes | Where the domain delegates right now, as the public internet sees it — which is what the customer compares against expected to know what to change. |
detected | boolean | Yes | Whether the domain's public NS records include the nameservers we asked for, resolved from a public recursive resolver. This — not our configuration and not the DNS vendor's… |
live | boolean | Yes | Whether the domain is being served by us right now. |
state | string<delegated, not_delegated, external, unknown> | Yes | The four-valued answer, and the field a client should render from. delegated — every nameserver we asked for is present. not_delegated — we hold this domain's zone, we got a… |
answered_by | string<resolver, registry, none> | Yes | Who answered. resolver is a public recursive resolver — what the internet sees. registry is the registry's own RDAP record, used as a fallback when the resolver says nothing… |
checked_at | string | Yes | When this reading was taken. |
last_delegated_at | string | Yes | When we last saw this domain delegated to us. Null means it never has been — which is what separates "waiting for you" from "this stopped working". |
next_check_at | string | Yes | When the background poller will look again, so a client can wait rather than poll blind. Null once the domain is live or the poller has given up. |
drifted | boolean | Yes | This domain was delegated to us and positively is not any more. A warning about something that broke, not a step still to do. |
served_by_us | object | No | Whether a one-time token placed in the site's files on our servers came back when fetched through the domain's PUBLIC name — the only reading that can say the domain reaches us… |
served_checked_at | object | No | When served_by_us was last measured, or null for never. |
www_resolves | object | No | Whether www. in front of the domain has any public address. null means the lookup did not answer, never that the name is missing. |
dns_actions | object[] | No | Records the customer must add at THEIR DNS provider, exactly as written — only for a domain whose DNS we do not run (in a zone delegated to us, the platform publishes the record… |
mail_measured | boolean | No | Whether the domain's published mail (MX, SPF) has been read yet. While false, a mail_mismatch of null means NOT CHECKED, not "matches" — a client shows that beside any… |
mail_mismatch | null | object | No | Present when the mail our copy of this domain's DNS would serve differs from the mail the domain publishes today — so changing nameservers to expected would change where its… |
dns_advice | string<keep_dns, records, nameservers> | No | Whether the customer may be told to change this domain's nameservers to expected at all (Q464). keep_dns: a partner moved the site here and the domain's DNS stays where it is… |
expected_ready | boolean | No | D43760. false when the nameserver pair we hold for this domain serves no zone for it: the DNS provider dropped a zone that was never activated. expected is then empty and… |
Errors this endpoint can return
401 · 403 · 404 · 429 · 503