Is Your Domain Secure from Subdomain Takeover? Check via API

security #api #domain #subdomaintakeover #defcon #whois #rapidapi #threatintel

DEF CON 32 made one thing clear: open-source security chips and hardware keys are having a moment. But while badges get the spotlight, most real-world attacks still start with something far less glamorous — a forgotten DNS record, a dangling CNAME, or a missing DMARC policy.

Subdomain takeover remains one of the most reliable paths from "benign misconfiguration" to "account compromise." If your organization owns dozens or hundreds of domains, manual checks do not scale. This is where an API-first domain intelligence tool becomes essential.

In this post, we'll use the Domain WHOIS API to automate:

• WHOIS/RDAP lookups and domain-age checks
• DNS record enumeration and SSL certificate inspection
• Subdomain discovery and takeover-risk scoring
• Email-security validation (SPF, DMARC, DKIM, DNSSEC, MTA-STS)
• Historical snapshots via /history

Why subdomain takeover still matters

A subdomain takeover happens when a DNS record points to a third-party service — GitHub Pages, Heroku, AWS S3, Vercel, etc. — that is no longer registered under your account. An attacker can claim the dangling endpoint and suddenly serve content under your brand's domain.

Bug bounty programs consistently rank subdomain takeovers as high-severity findings because they enable phishing, session hijacking, and reputation abuse. The root cause is usually an orphaned CNAME that nobody is monitoring.

The fix is continuous monitoring. Instead of running dig, whois, and openssl by hand, we can consolidate everything into a single API call.

What the Domain WHOIS API returns

The API combines several data sources into one response:

Capability	Use case
WHOIS via RDAP	Ownership, registrar, creation/expiration dates
DNS records	A, AAAA, CNAME, MX, NS, TXT records
SSL certificate	Issuer, expiry, SANs, validity
Subdomain discovery	Asset inventory and shadow-IT detection
Takeover risk	Dangling CNAME/A-record scoring
Email security	SPF, DMARC, DKIM, DNSSEC, MTA-STS
Time-travel history	Track posture changes over time

This single API can replace a handful of separate tools in a security pipeline.

Code example: Basic domain intelligence in Python

Let's start with a simple script that fetches WHOIS, DNS, and email-security data for a domain.

import requests

RAPIDAPI_KEY = "your-rapidapi-key"
RAPIDAPI_HOST = "domain-whois2.p.rapidapi.com"
BASE_URL = "https://domain-whois2.p.rapidapi.com"

headers = {
    "X-RapidAPI-Key": RAPIDAPI_KEY,
    "X-RapidAPI-Host": RAPIDAPI_HOST,
}

def check_domain(domain):
    url = f"{BASE_URL}/whois"
    params = {"domain": domain}
    resp = requests.get(url, headers=headers, params=params, timeout=30)
    resp.raise_for_status()
    return resp.json()

if __name__ == "__main__":
    data = check_domain("example.com")
    print("Registrar:", data.get("registrar"))
    print("Created:", data.get("creation_date"))
    print("Email security:", data.get("email_security"))

The response includes registrar details, domain age, and an email-security score. A low score usually means missing DMARC or weak SPF.

Detecting subdomain takeover risk

The API's takeover endpoint scores subdomains based on dangling records. A high-risk subdomain is one whose CNAME resolves to a service that returns a "not found" or configurable error page.

def takeover_risk(domain):
    url = f"{BASE_URL}/takeover"
    params = {"domain": domain}
    resp = requests.get(url, headers=headers, params=params, timeout=60)
    resp.raise_for_status()
    return resp.json()

def alert_on_high_risk(domain):
    report = takeover_risk(domain)
    for sub in report.get("subdomains", []):
        if sub.get("risk_score", 0) >= 70:
            print(f"ALERT: {sub['name']} has takeover risk {sub['risk_score']}")
            print(f"  CNAME: {sub.get('cname')}")
            print(f"  Service: {sub.get('service')}")

Schedule this with GitHub Actions or a cron job to catch new dangling records before attackers do.

Validating email security protocols

Email spoofing and BEC attacks exploit weak or missing SPF, DMARC, and DKIM records. The API returns a structured email-security object so you don't have to parse TXT records yourself.

def email_security_score(domain):
    url = f"{BASE_URL}/email-security"
    params = {"domain": domain}
    resp = requests.get(url, headers=headers, params=params, timeout=30)
    resp.raise_for_status()
    data = resp.json()
    score = data.get("score", 0)
    print(f"Email security score for {domain}: {score}/100")
    for check in data.get("checks", []):
        print(f"  {check['name']}: {check['status']}")
    return data

Common gaps the API flags:

• SPF record missing or too permissive (+all)
• DMARC missing or set to p=none
• DKIM not configured
• DNSSEC disabled
• MTA-STS policy missing

Tracking changes with historical snapshots

The /history endpoint lets you compare today's posture against previous snapshots. This is useful for proving compliance or catching regressions.

def get_history(domain, days=30):
    url = f"{BASE_URL}/history"
    params = {"domain": domain, "days": days}
    resp = requests.get(url, headers=headers, params=params, timeout=30)
    resp.raise_for_status()
    return resp.json()

history = get_history("example.com")
for snapshot in history.get("snapshots", []):
    print(snapshot["date"], snapshot["email_security_score"])

How to use Domain WHOIS API

The API is hosted on RapidAPI. Sign up, subscribe, and grab your API key from the dashboard.

cURL example

curl --request GET \
  --url 'https://domain-whois2.p.rapidapi.com/whois?domain=example.com' \
  --header 'X-RapidAPI-Host: domain-whois2.p.rapidapi.com' \
  --header 'X-RapidAPI-Key: your-rapidapi-key'

Python example

import requests

url = "https://domain-whois2.p.rapidapi.com/whois"
querystring = {"domain": "example.com"}
headers = {
    "X-RapidAPI-Key": "your-rapidapi-key",
    "X-RapidAPI-Host": "domain-whois2.p.rapidapi.com"
}

response = requests.get(url, headers=headers, params=querystring)
print(response.json())

For full endpoint documentation and pricing, visit the Domain WHOIS API on RapidAPI. The source code and additional examples are available on GitHub.

Putting it together: a minimal monitoring pipeline

Combine the snippets above into a single script that runs daily:

1. Load your domain list from a CSV or asset-inventory API.
2. Call /takeover and /email-security for each domain.
3. Alert on risk scores above 70 or email scores below 80.
4. Append results to /history for trend analysis.

DOMAINS = ["example.com", "api.example.com", "blog.example.com"]

for domain in DOMAINS:
    takeover = takeover_risk(domain)
    email = email_security_score(domain)
    if email.get("score", 100) < 80:
        send_alert(f"Email security degraded on {domain}")

Conclusion

DEF CON's focus on open-source security hardware is inspiring, but most organizations will get more immediate value from automating the basics: monitoring DNS, validating email security, and eliminating dangling subdomains. The Domain WHOIS API wraps WHOIS/RDAP, DNS, SSL, subdomain discovery, takeover risk, and email-security scoring into a single interface that fits naturally into CI/CD, bug-bounty workflows, or threat-intel pipelines.

If you're building a security automation tool, start with the Domain WHOIS API on RapidAPI and check out the examples on GitHub. A few API calls today can prevent a subdomain takeover headline tomorrow.