issued.live is live

issued.live is open to the public today. This note is about how it is built and why it behaves the way it does, because those choices are the difference between a lookup you can rely on and one that quietly guesses.

Where the corpus stands

The index covers hundreds of millions of domains and reads the public Certificate Transparency logs continuously. Ingest sustains tens of thousands of entries per second, and the current counts are served live by the statistics endpoint. Every domain's DNS is re-scanned on a rolling cycle, so a record reflects a confirmed observation rather than a lookup performed while you wait.

Observational, not authoritative

The most important design decision here is what this service refuses to do.

We publish what we saw and when we saw it. We do not reconcile that against a registry, we do not fill gaps with plausible values, and we do not derive one field from another because the shapes happen to fit. Where we hold nothing, the field is null and the interface says so in words. A blank that means "unknown" and a blank that means "does not exist" are different facts, and collapsing them is how a monitoring tool starts lying to the person depending on it.

This is also why every record carries last_update. Freshness is yours to judge, not something you have to take on trust.

Built to be read by machines first

Most of what queries this service will not be a browser. So the same record is served three ways from one URL: JSON by default, Markdown by appending .md, and the Model Context Protocol at /mcp for agents that would otherwise scrape a page built for human eyes. Six MCP tools are exposed, three of which need no credential at all.

There is a /llms.txt at the root describing what is worth fetching, and the site root answers plain text to a terminal rather than dumping statistics at it. None of this is decoration - an agent that has to parse layout is an agent that breaks on the next redesign.

Free by default

A thousand domain lookups a day require no key, no account, and no sign-up. The rolling certificate feed and the corpus statistics are open on the same terms. The keyed endpoints - asking which names sit on an address or a range, following newly registered domains, and searching the corpus - answer questions that are expensive to compute, so they sit on the paid plans. The pricing page lists what each plan reaches.

What comes next

Coverage of the remaining CT logs, longer retained history on address changes, and a tighter DNS re-scan interval as capacity allows. If something looks wrong in a record, that is worth reporting - a wrong observation is a bug here, not a rounding error.

Documentation lives at /developers. issued.live is built by Tuxxin.