domain-check

Domain Check is an authoritative domain availability checker that queries registry RDAP servers directly, presenting RDAP as the ICANN-mandated successor to WHOIS. The README compares the two: RDAP uses HTTPS with structured JSON, while WHOIS uses plaintext TCP port 43, lacks .dev and .app support, and returns registry-specific text that is fragile to parse. The project states that in its tests whois reported a registered domain as available, while RDAP was accurate across the test cases, and it links a research document on accuracy comparison. Interfaces. The project offers three ways to query it. A web UI provides a no-signup form. A REST API lives under /api/v1/ and supports single-domain checks, a multi-TLD check that passes a comma-separated tlds parameter, a bulk POST endpoint taking up to 50 domains with a 64 KB body limit, and a health endpoint. API responses are JSON and report the domain, availability, TLD, check timestamp, data source, cache status and duration; for registered domains they also include registrar, creation and expiry dates, nameservers and status codes. A CLI provides check and bulk subcommands, multi-TLD checking, JSON or CSV output, a progress indicator for bulk runs, configurable concurrency, and documented exit codes: 0 when all checked domains are available, 1 when at least one is taken, and 2 on error. Domain Watch. An optional feature enabled with the enable-watch flag polls watched domains and sends a webhook when one transitions from registered to available. Registering a watch returns an id, the webhook URL and an HMAC secret; deliveries include an X-DomainCheck-Signature header containing an sha256-prefixed signature that receivers verify with the secret. Watches are single-fire, expire after 90 days, are limited to 10 per IP per 24 hours with a 15-minute default polling interval, and are described as including SSRF protection, private-IP blocking and DNS rebinding prevention. Only the domain and webhook URL are stored. Rate limits are enforced per IP: 10 requests per minute for the web UI, 60 for the single-check API and 5 for bulk, with over-limit requests returning 429 and a Retry-After header. Self-hosting and configuration. Domain Check is a single Go binary with no runtime dependencies, or a Docker image; building from source requires Go 1.26 or newer. Templates and static assets are embedded in the binary. Settings can be given as flags, DOMCHECK_ environment variables, or a YAML config file, with precedence flags over env vars over config file over defaults. Documented parameters cover the listen address, LRU cache size and separate cache TTLs for available and registered results, IANA RDAP bootstrap refresh interval, trust-proxy handling of X-Forwarded-For, CORS origins, a Prometheus metrics endpoint, log format and level, and the watch database path, poll interval, maximum TTL and per-IP watch limit. Reverse proxy examples are given for Caddy and nginx. Architecture. The code is organized into a command entry point plus internal packages for the check engine (RDAP client, WHOIS fallback, DNS pre-filter, IANA bootstrap loader, LRU cache, SSRF guard, per-registry rate limiting), layered config, domain validation with IDN-to-punycode and publicsuffix TLD extraction, the HTTP server and handlers, and the CLI. The README describes the request flow as validation, cache lookup, DNS pre-filter to short-circuit clearly registered names, per-registry rate limiting, the RDAP query, parsing, cached storage and JSON response. Default cache TTLs are listed as 5 minutes for available results, 1 hour for registered results and 30 seconds for errors. Security and maintenance. The README lists SSRF protection, security headers (CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy), a non-root Docker user and zero tracking with no analytics, cookies or data retention. Development uses go test, fuzz testing and golangci-lint, and the repository notes aggressive automatic git garbage collection settings. The project is MIT licensed and is described as a read-only GitHub mirror of a self-hosted git instance, with a mirror test note at the end.