issued.live is open to the public today. This note is about how it is built and why it behaves the way it does, because those choices are the difference between a lookup you can rely on and one that quietly guesses.
Where the corpus stands
At launch the index holds 334 million domains and ingested roughly 15.9 million certificates in the preceding twenty-four hours, reading 56 of the 58 known Certificate Transparency logs. Ingest sustains tens of thousands of entries per second. Every domain's DNS is re-scanned on a rolling cycle so a record reflects a confirmed observation rather than a lookup performed while you wait.
Observational, not authoritative
The most important design decision here is what this service refuses to do.
We publish what we saw and when we saw it. We do not reconcile that against a registry, we do not fill gaps with plausible values, and we do not derive one field from another because the shapes happen to fit. Where we hold nothing, the field is null and the interface says so in words. A blank that means "unknown" and a blank that means "does not exist" are different facts, and collapsing them is how a monitoring tool starts lying to the person depending on it.
This is also why every record carries last_update. Freshness is yours to judge, not something you have to take on trust.
Built to be read by machines first
Most of what queries this service will not be a browser. So the same record is served three ways from one URL: JSON by default, Markdown by appending .md, and the Model Context Protocol at /mcp for agents that would otherwise scrape a page built for human eyes. Six MCP tools are exposed, three of which need no credential at all.
There is a /llms.txt at the root describing what is worth fetching, and the site root answers plain text to a terminal rather than dumping statistics at it. None of this is decoration — an agent that has to parse layout is an agent that breaks on the next redesign.
Free by default
A thousand domain lookups a day require no key, no account, and no sign-up. The rolling certificate feed and the corpus statistics are open on the same terms. A free key exists only for the reverse direction — asking which names sit on an address or a range, and following newly registered domains — because those queries are expensive to answer and worth rate-limiting honestly rather than degrading for everyone.
What comes next
Coverage of the remaining CT logs, longer retained history on address changes, and a tighter DNS re-scan interval as capacity allows. If something looks wrong in a record, that is worth reporting — a wrong observation is a bug here, not a rounding error.
Documentation lives at /developers. issued.live is built by Tuxxin.
