BLAZINGFAST — DOMAINS
Reviewed: 5 October 2026. Setup: 00-index.txt.
Production release: SDK/CLI 0.1.17; contract 2026-10-07.1. Check GET /v1/version and GET /v1/capabilities before using optional workflow features. Strict response validation is enforced.

PURPOSE
Register, transfer and renew supported domain names; manage nameservers,
registration contacts, transfer lock and eligible privacy settings.
Allowed periods and requirements vary by TLD. Discover availability and prices.

PUBLIC API
GET /v1/domains/tlds, /check, /search, /suggest: catalog and availability.
GET /v1/domains and /v1/domains/{serviceId}: owned registrations.
GET .../status and .../transfer-status: registrar operation state.
PUT .../nameservers, .../lock, .../whois-privacy: eligible changes.
Contacts: /v1/domains/contacts and domain contact assignment endpoints.
POST .../auth-code: sensitive transfer authorization workflow.
Generic service renewal/options and renewal/checkout create eligible renewal
invoices; full payment can dispatch renewal. Availability does not buy a domain.
Permissions: domains.read / domains.write; separate service/billing scopes.

CLI
bf domain tlds
bf domain check example.com
bf domain list
bf domain status SERVICE_UUID
bf domain transfer-status SERVICE_UUID
Use bf domain --help for nameservers, contacts, lock and privacy changes.
No dedicated CLI renewal checkout command; use API/SDK or the dashboard.

MCP
Hosted: list_domains, get_domain, get_domain_status, get_domain_transfer_status;
request_domain_nameservers, request_domain_lock, request_domain_privacy.
Generic get_service_renewal_options reads options; it does not issue an invoice.
Local: bf_domain_tlds/check/search/suggest/list/show/status/transfer_status,
bf_domain_contacts_list. No domain write/renewal tools in local MCP.
Hosted MCP does not expose an authorization-code or DNSSEC tool.

LIMITS AND SAFETY
Use the registered domain's service UUID, not its DNS zone's identifier.
Domain registration and DNS hosting are different resources. Changing delegation
may interrupt DNS/web/mail service. Registered-domain DNSSEC is public through
GET/POST /v1/domains/{serviceId}/dnssec. GET and action=refresh need domains.read;
action=enable (mode=managed or external) and disable need domains.write,
acknowledge=true and an Idempotency-Key (8–128 letters/digits/._:-). External mode
accepts 1–4 public DNSKEYs; never submit private keys. Refresh returns HTTP200;
enable/disable return HTTP202. Poll the same DNSSEC GET and inspect operation,
status and errorCode; operationId is not a generic /v1/operations handle.
unconfirmed requires reconciliation; failed is not success. Registrar-configured
does not verify parent propagation (delegationStatus=not_verified). A managed
enable also requires your ready, unlocked DNS zone; TLD support is discovered
from support/canEnable/canDisable. Reuse the original retry key and exact body.
CLI: bf domain dnssec show/check/enable/disable; writes require --confirm and
--request-key; external enable needs --keys-file. Local MCP: bf_domain_dnssec,
bf_domain_dnssec_check; opt-in bf_domain_dnssec_update. Hosted MCP has none.
Registrar acceptance and parent-zone propagation are different events.
After uncertain renewal/registration results, reconcile state before retrying.