issued.live is live
issued.live is open to the public today. This note is about how it is built and why it behaves the way it does, because those choices are the difference between a lookup you can rely on and one that quietly guesses.
Where the corpus stands
At launch the index holds 334 million domains and ingested roughly 15.9 million certificates in the preceding twenty-four hours, reading 56 of the 58 known Certificate Transparency logs. Ingest sustains tens of thousands of entries per second. Every domain's DNS is re-scanned on a rolling cycle so a record reflects a confirmed observation rather than a lookup performed while you wait.
Observational, not authoritative
The most important design decision here is what this service refuses to do.
We publish what we saw and when we saw it. We do not reconcile that against a registry,
we do not fill gaps with plausible values, and we do not derive one field from another
because the shapes happen to fit. Where we hold nothing, the field is null and
the interface says so in words. A blank that means "unknown" and a blank that means "does
not exist" are different facts, and collapsing them is how a monitoring tool starts lying to
the person depending on it.
This is also why every record carries last_update. Freshness is yours to
judge, not something you have to take on trust.
Built to be read by machines first
Most of what queries this service will not be a browser. So the same record is served
three ways from one URL: JSON by default, Markdown by appending .md, and the
Model Context Protocol at /mcp for agents that would otherwise scrape a page
built for human eyes. Six MCP tools are exposed, three of which need no credential at all.
There is a /llms.txt at the root describing what is worth fetching, and the
site root answers plain text to a terminal rather than dumping statistics at it. None of
this is decoration — an agent that has to parse layout is an agent that breaks on the
next redesign.
Free by default
A thousand domain lookups a day require no key, no account, and no sign-up. The rolling certificate feed and the corpus statistics are open on the same terms. A free key exists only for the reverse direction — asking which names sit on an address or a range, and following newly registered domains — because those queries are expensive to answer and worth rate-limiting honestly rather than degrading for everyone.
What comes next
Coverage of the remaining CT logs, longer retained history on address changes, and a tighter DNS re-scan interval as capacity allows. If something looks wrong in a record, that is worth reporting — a wrong observation is a bug here, not a rounding error.
Documentation lives at /developers. issued.live is built by Tuxxin.
