ToolMint Domain Intel

Routes and prices

Free routes: /, /health, /openapi.json, /.well-known/x402.

Try it

Copycurl -i "https://toolmint-domain-intel.toolmint.workers.dev/intel?domain=example.com"

When to use it

• Before an agent follows a link or trusts a sender domain: check domain age, registrar, nameservers, SPF/DMARC, certificate history and whether https://domain/ redirects elsewhere.
• Feed the risk.reasons list to a human or a second check.

Not for: malware or phishing classification, reputation, or identifying the owner. Subdomains: RDAP is looked up for the exact name you give, so use the registered domain (for example example.com, not www.example.com).

Example

curl -i "https://toolmint-domain-intel.toolmint.workers.dev/intel?domain=example.com"

That hostname is the planned Worker name. The tool is not deployed yet.

Trimmed response (values illustrative):

{
  "ok": true,
  "domain": "example.com",
  "queriedAt": "2026-10-31T12:00:00.000Z",
  "registration": {
    "registrar": "...", "created": "1995-08-14T04:00:00Z", "updated": "...", "expires": "...",
    "ageDays": 11400, "status": ["client delete prohibited"], "nameservers": ["a.iana-servers.net"],
    "rdapUrl": "https://rdap.verisign.com/com/v1/domain/example.com"
  },
  "dns": {
    "a": ["203.0.113.10"], "aaaa": [], "mx": [], "txt": ["v=spf1 -all"],
    "spf": "v=spf1 -all", "dmarc": null,
    "ssrf": { "blocked": false, "privateIps": [] }, "rcode": 0
  },
  "tls": {
    "source": "crt.sh", "issuer": "...", "notBefore": "...", "notAfter": "...",
    "validNow": true, "sans": ["example.com"]
  },
  "redirect": { "checked": true, "redirected": false, "status": 200, "location": null },
  "risk": { "newlyRegistered": false, "suspicious": false, "score": 5, "reasons": ["no DMARC (_dmarc) policy"] },
  "provenance": {
    "tool": "domain-intel-json", "version": "0.1.0",
    "sources": ["IANA RDAP bootstrap (data.iana.org/rdap/dns.json)", "Registry RDAP (per TLD, https only)",
                "Cloudflare DoH JSON (cloudflare-dns.com)", "crt.sh Certificate Transparency JSON"],
    "priceUsd": "0.02", "network": "eip155:8453",
    "note": "Heuristic aggregation of public signals only - not a guarantee of legitimacy or safety.",
    "notChecked": ["Live TLS handshake / certificate chain ...", "Page content, phishing kits, malware or reputation/blocklist feeds", "..."]
  }
}

If a source fails, its section carries an error and risk.reasons says "unknown" for it; those failures are not counted as risk.

How the score is built: newly registered (30 days or less) +40; 31-90 days old +20; no RDAP record for the exact name +10; resolves to private IPs +50; no A/AAAA +15; no SPF +5; no DMARC +5; no certificates in CT logs +10; latest CT certificate not currently valid +25; off-domain redirect +10. suspicious is true at 35 or more, or when newly registered, or on private IPs.

Data sources and licence

IANA RDAP bootstrap and the registry's RDAP server (public registration data), Cloudflare DNS-over-HTTPS, and crt.sh (public Certificate Transparency search run by Sectigo). Each has its own terms; crt.sh has no SLA and may be slow or unavailable. Some country-code TLDs have no RDAP, so registration data is missing for them.

Freshness and caching

Domain results are not cached; each call queries the sources live (only the IANA bootstrap list is cached, for 6 hours). queriedAt is the time of the lookup. CT data covers unexpired certificates for the exact name.

Limits

• Heuristic, not a verdict; no reputation or content checks.
• Exact-name lookups (no public-suffix handling).
• crt.sh and some RDAP registries rate-limit and can be slow (RDAP up to 12 s, crt.sh up to 10 s).
• No live TLS handshake (certificate data comes from CT logs).

Errors are not charged

Payment settles only on a successful answer. These responses are never settled: