{"uid":"cap_soinaqYe75eMW8D-22-uD","slug":"domain-intelligence-lookup-rdap-dns-spf-dmarc-tls-certs-fcea3686","name":"Domain Intelligence Lookup (RDAP, DNS, SPF, DMARC, TLS Certs)","description":"Use when you need a whois or domain lookup, dns records, email security checks or certificate transparency data for osint or due diligence. Do not use for historical whois, registrant personal data (redacted by registries) or port and vulnerability scans. Returns JSON with a domain's registration (RDAP: registrar, dates, status, DNSSEC), DNS records, SPF and DMARC, and recent TLS certificates for 0.02 USDC per call. Typical response time 4000 ms (p95). Category: Data.","url":"https://x402-gateway.blackwoodstate8.workers.dev/v1/domain-intel?utm_source=zero.xyz","method":"POST","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method","bodyType","body"],"properties":{"body":{"type":"object","required":["domain"],"properties":{"domain":{"type":"string","pattern":"^(?:[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?\\.)+[A-Za-z]{2,63}\\.?$","maxLength":254,"description":"Domain name in ASCII (punycode for internationalized names), e.g. example.com"},"certificates":{"type":"boolean","description":"Include issued TLS certificates from Certificate Transparency (crt.sh); true when omitted"}}},"type":{"type":"string","const":"http"},"method":{"enum":["POST"],"type":"string"},"bodyType":{"enum":["json","form-data","text"],"type":"string"}},"additionalProperties":false},"output":{"type":"object","required":["type"],"properties":{"type":{"type":"string"},"example":{"type":"object","required":["domain","registered","registration","dns","email","certificates","partial"],"properties":{"dns":{"type":"object","required":["a","aaaa","mx","ns","txt","caa"],"properties":{"a":{"type":"array","items":{"type":"string"}},"mx":{"type":"array","items":{"type":"object","required":["priority","host"],"properties":{"host":{"type":"string"},"priority":{"type":"integer","maximum":9007199254740991,"minimum":-9007199254740991}},"additionalProperties":false}},"ns":{"type":"array","items":{"type":"string"}},"caa":{"type":"array","items":{"type":"string"}},"txt":{"type":"array","items":{"type":"string"}},"aaaa":{"type":"array","items":{"type":"string"}}},"additionalProperties":false},"next":{"type":"object","required":["service","tool","method","url","useWhen","sample"],"properties":{"url":{"type":"string","description":"Paid route of the next call"},"tool":{"type":"string","description":"MCP tool name of the same call"},"method":{"enum":["GET","POST"],"type":"string"},"sample":{"type":"string","description":"Free fixed sample of the whole family"},"service":{"type":"string","description":"Service id of the suggested next paid call"},"useWhen":{"type":"string","description":"When the next call is the right one"}},"description":"Suggested next paid call in the same family (call it in a loop when the task continues)","additionalProperties":false},"email":{"type":"object","required":["spf","dmarc","dmarcPolicy"],"properties":{"spf":{"type":["string","null"]},"dmarc":{"type":["string","null"]},"dmarcPolicy":{"type":["string","null"]}},"additionalProperties":false},"domain":{"type":"string"},"partial":{"type":"array","items":{"type":"string"}},"registered":{"type":["boolean","null"]},"certificates":{"anyOf":[{"type":"object","required":["total","recent"],"properties":{"total":{"type":"integer","maximum":9007199254740991,"minimum":-9007199254740991},"recent":{"type":"array","items":{"type":"object","required":["issuer","commonName","notBefore","notAfter"],"properties":{"issuer":{"type":"string"},"notAfter":{"type":"string"},"notBefore":{"type":"string"},"commonName":{"type":"string"}},"additionalProperties":false}}},"additionalProperties":false},{"type":"null"}]},"registration":{"anyOf":[{"type":"object","required":["registrar","created","updated","expires","status","nameservers","dnssec","rdapServer"],"properties":{"dnssec":{"type":["boolean","null"]},"status":{"type":"array","items":{"type":"string"}},"created":{"type":["string","null"]},"expires":{"type":["string","null"]},"updated":{"type":["string","null"]},"registrar":{"type":["string","null"]},"rdapServer":{"type":["string","null"]},"nameservers":{"type":"array","items":{"type":"string"}}},"additionalProperties":false},{"type":"null"}]}},"additionalProperties":false}}}}},"responseSchema":{"type":"json","example":{"dns":{"a":["104.20.23.154","172.66.147.243"],"mx":[],"ns":["elliott.ns.cloudflare.com","hera.ns.cloudflare.com"],"caa":[],"txt":["v=spf1 -all","_k2n1y4vw3qtb4skdx9e7dxt97qrmmq9"],"aaaa":["2606:4700:10::6814:179a","2606:4700:10::ac42:93f3"]},"email":{"spf":"v=spf1 -all","dmarc":"v=DMARC1;p=reject;sp=reject;adkim=s;aspf=s","dmarcPolicy":"reject"},"domain":"example.com","partial":[],"registered":true,"certificates":null,"registration":{"dnssec":true,"status":["client delete prohibited","client transfer prohibited","client update prohibited"],"created":"1995-08-14T04:00:00Z","expires":"2027-08-13T04:00:00Z","updated":"2026-08-14T08:01:43Z","registrar":"RESERVED-Internet Assigned Numbers Authority","rdapServer":"rdap.verisign.com","nameservers":["elliott.ns.cloudflare.com","hera.ns.cloudflare.com"]}}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.02","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"registry","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.02/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.02","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.02","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_2soxrHUFXYngWuEbaD5bY","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.02","costPer":"request","priority":0,"asset":null,"unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Returns comprehensive domain intelligence including RDAP registration data, DNS records, email security (SPF/DMARC), and certificate transparency logs for a given domain.","exampleAgentPrompt":"Can you pull the full domain intel on stripe.com — I need the RDAP registration details, all DNS records, SPF and DMARC config, and any TLS certificates that have been issued for it?","exampleUseCases":[{"title":"Due diligence on a vendor domain","prompt":"I'm evaluating a new vendor and want to do some due diligence — can you look up the RDAP registration, DNS records, and email security setup for acmecorp.io so I can see who registered it, when it expires, and whether their mail is properly secured?"},{"title":"Email deliverability security audit","prompt":"We're having email deliverability issues and I suspect our SPF and DMARC aren't set up right — can you check the DNS and email security records for mycompany.com and tell me what SPF and DMARC policies are currently published?"},{"title":"OSINT investigation on suspicious domain","prompt":"I received a phishing-looking email from payments-secure-notice.net — can you pull the domain registration info, DNS records, and any TLS certificates issued for it so I can see how new it is and who's behind it?"}],"resultDescription":"A JSON object containing: domain registration data from RDAP (registrar, creation/expiry dates, domain status flags, DNSSEC status), full DNS record sets (A, AAAA, MX, NS, TXT, CAA), parsed SPF and DMARC email security records, and a list of recent TLS certificates from Certificate Transparency logs (crt.sh). Optionally includes a 'next' hint for chaining further lookups.","failureModes":["Invalid domain format returns validation error","Domain not found in RDAP returns empty registration object","DNS resolution failure for non-existent domain returns empty record arrays","Certificate Transparency lookup timeout may return partial certificate data","Rate limiting or upstream RDAP registry unavailability may cause partial responses"],"whenToPreferThis":"Use this endpoint when you need a single API call that aggregates RDAP registration, DNS records, email security (SPF/DMARC), and certificate transparency data for a domain — particularly for OSINT, security research, or vendor due diligence. Prefer this over manual DNS tools or separate WHOIS/RDAP queries when you need all domain signals in one structured JSON response. Not suitable for historical WHOIS, registrant PII (redacted by registries), or port/vulnerability scanning.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-23T00:39:51.106Z","isFirstParty":false,"canonicalSlug":"domain-intelligence-lookup-rdap-dns-spf-dmarc-tls-certs-fcea3686"}