Check whether a domain is burning
Catch a DNS, certificate, or link-delivery problem before fans complain.
GET /api/admin/domain-reputation returns the latest scan verdict for every domain you can
see — scoped the same way the rest of the panel is (a team member only sees their own domains).
Reading the verdict
Each domain gets one of three statuses, worst-first in the response:
| Status | Meaning |
|---|---|
ok | Nothing wrong found |
watch | TLS expires within 10 days, or link deliverability is dropping (an early platform-restriction signal) |
burned | DNS doesn't resolve, the TLS certificate has expired, or Google Safe Browsing flagged it |
The response also carries ts / age_seconds / stale (the scan is considered stale after an
hour — stale: true means treat the verdict cautiously, not as current), a summary count per
status, and gsb_enabled.
gsb_enabled: false means the scan has no Google Safe Browsing key configured — the verdict only
covers DNS and TLS, not Google's own blacklist. A green ok in that state doesn't mean "not
blacklisted," it means "not checked against that list."
What to do about it
watch— plan ahead; nothing is broken yet.burned— move off it rather than waiting for it to self-heal. A rotation's own preflight check treats aburnedreserve as a hard block, but treats a domain with no verdict at all (never scanned) as fine to use — an absent verdict is "not looked at yet," never a false burn signal.
What's next
Found a burned domain? See Move off a burned domain.