---
title: "Get DNS records"
method: GET
path: "/domains/{id}/dns-records"
tags: ["Domain"]
---

# Get DNS records

`GET /domains/{id}/dns-records`

## Request

- Base URL: `https://api.palisade.email`
- URL: `https://api.palisade.email/domains/{id}/dns-records`
- Auth: one of:
  - HTTP bearer
  - HTTP basic

Returns the consolidated, server-computed list of DNS records to publish for this domain, covering every enabled Palisade-managed feature (DMARC, SPF, DKIM, MTA-STS, TLS-RPT, BIMI) with per-record verification status. Records that are not yet verified are compared against live DNS, so "action" reflects what is actually published and "already_published" identifies records that need no change. Also reports the detected DNS provider hosting the domain, resolved from its live NS records, so the records can be published with a matching DNS integration.

## Path parameters

- `id` string, uuid, required

## Headers

- `Palisade-Version` '2025-04-30' | 'unstable', required

## Response `200`

Success

- DnsRecordsResponse
  - `records` DnsRecord[], required
    - `purpose` 'dmarc' | 'spf' | 'dkim' | 'mta_sts' | 'mta_sts_policy' | 'tls_rpt' | 'bimi', required
    - `type` 'TXT' | 'CNAME' | 'NS', required
    - `host` string, required: Fully qualified record name.
    - `relative_host` string, required: Record name relative to the domain apex; "@" designates the apex itself.
    - `value` string, required
    - `ttl` integer, required: Recommended TTL in seconds.
    - `action` 'create' | 'replace' | 'delete', required: How to publish this record, derived from what is currently live in DNS. "create" means nothing serving this purpose exists at the host yet; "replace" means a record for this purpose already occupies the host and must be overwritten with this value; "delete" means the record must be removed. When already_published is true the record is already correct and "replace" would be a no-op, so use already_published to decide whether to act at all.
    - `required` boolean, required: False for records that improve an enabled feature but are not needed for it to function.
    - `status` 'pending' | 'verifying' | 'verified' | 'drifted', required
    - `already_published` boolean, nullable, required: True when live DNS already serves exactly this value, so the record can be skipped. False when it is missing or serving something else. Null when the live lookup could not be completed, in which case "action" falls back to a static, type-derived value and should be treated as a best-effort hint.
  - `all_verified` boolean, required: True when every required record has status "verified".
  - `warnings` DnsRecordWarning[], required: Risks to resolve before publishing these records. Empty in the normal case. Read these before applying anything: publishing an enforcing DMARC policy on a domain with no working SPF or DKIM causes receivers to reject or quarantine its mail.
    - `code` string, required: Stable identifier for the warning, safe to branch on.
    - `message` string, required: Human-readable explanation of the risk.
  - `dns_provider` DetectedDnsProvider, required: Where the domain's DNS is hosted, so the records can be published with a matching DNS tool, connector, or provider API. This is the DNS host, which is often not the registrar reported in "registrar".
    - `id` string, nullable, required: Identifier of the DNS provider hosting the domain, derived from its live NS records. Deliberately an open set: ids recognized today are cloudflare, route53, godaddy, azure, google, namecheap, digitalocean, vercel, dnsimple, gandi, ovh, name.com, porkbun, hetzner, linode, networksolutions, microsoft365, wix, squarespace, ionos, hostinger, siteground, bluehost, hostgator, dreamhost, dnsmadeeasy, akamai, rackspace, cloudns, comodo, easydns, encirca, webnames, whc, rebel, register.com, hover, namesilo, dynadot, spaceship, one.com, enom, wordpress.com, hurricane-electric, and more are added over time, so treat an unfamiliar id the same as null rather than rejecting the response. Null when the nameservers do not match a known provider, disagree with each other, or could not be resolved — in that case use "nameservers" to decide, and never assume a provider.
    - `nameservers` string[], required: The nameservers the domain is delegated to. Empty when the lookup failed or returned nothing.

---

[API](https://skmtc.dev/palisade/apis/palisade-api.md) · [All operations](https://skmtc.dev/palisade/apis/palisade-api/llms.txt) · [OpenAPI document](https://skmtc.dev/palisade/apis/palisade-api/revisions/37b4ae5a7766?raw)