# ToolMint Domain Intel

> Check whether a domain or link looks legit before an agent acts: RDAP registration (IANA bootstrap), DNS via Cloudflare DoH (A/AAAA/MX/TXT + SPF/DMARC), TLS from crt.sh CT, redirect probe, newly-registered/suspicious risk flag. SSRF-guarded. Heuristic signals only. Price per call in pricing below (USDC on Base).

- Status: Coming soon
- Price: $0.02 / call (x402 exact, USDC on Base eip155:8453, payTo 0xfbF7413bcB3a604936775C96FDbe0b0C9c9E37F5)
- Planned URL: https://toolmint-domain-intel.toolmint.workers.dev
- OpenAPI: https://toolmint.toolmint.workers.dev/tools/domain-intel-json/openapi.json

## Routes

- `GET /intel` $0.02: Domain intel by query domain=
- `GET /intel/{domain}` $0.02: Domain intel by path
- `GET /check` $0.02: Alias of /intel

## When to use it

- Before an agent follows a link or trusts a sender domain: check domain age, registrar, nameservers, SPF/DMARC, certificate history and whether `https://domain/` redirects elsewhere.
- Feed the `risk.reasons` list to a human or a second check.

Not for: malware or phishing classification, reputation, or identifying the owner. Subdomains: RDAP is looked up for the exact name you give, so use the registered domain (for example `example.com`, not `www.example.com`).

## Example

```bash
curl -i "https://toolmint-domain-intel.toolmint.workers.dev/intel?domain=example.com"
```

That hostname is the planned Worker name. The tool is **not deployed yet**.

Trimmed response (values illustrative):

```json
{
  "ok": true,
  "domain": "example.com",
  "queriedAt": "2026-10-31T12:00:00.000Z",
  "registration": {
    "registrar": "...", "created": "1995-08-14T04:00:00Z", "updated": "...", "expires": "...",
    "ageDays": 11400, "status": ["client delete prohibited"], "nameservers": ["a.iana-servers.net"],
    "rdapUrl": "https://rdap.verisign.com/com/v1/domain/example.com"
  },
  "dns": {
    "a": ["203.0.113.10"], "aaaa": [], "mx": [], "txt": ["v=spf1 -all"],
    "spf": "v=spf1 -all", "dmarc": null,
    "ssrf": { "blocked": false, "privateIps": [] }, "rcode": 0
  },
  "tls": {
    "source": "crt.sh", "issuer": "...", "notBefore": "...", "notAfter": "...",
    "validNow": true, "sans": ["example.com"]
  },
  "redirect": { "checked": true, "redirected": false, "status": 200, "location": null },
  "risk": { "newlyRegistered": false, "suspicious": false, "score": 5, "reasons": ["no DMARC (_dmarc) policy"] },
  "provenance": {
    "tool": "domain-intel-json", "version": "0.1.0",
    "sources": ["IANA RDAP bootstrap (data.iana.org/rdap/dns.json)", "Registry RDAP (per TLD, https only)",
                "Cloudflare DoH JSON (cloudflare-dns.com)", "crt.sh Certificate Transparency JSON"],
    "priceUsd": "0.02", "network": "eip155:8453",
    "note": "Heuristic aggregation of public signals only - not a guarantee of legitimacy or safety.",
    "notChecked": ["Live TLS handshake / certificate chain ...", "Page content, phishing kits, malware or reputation/blocklist feeds", "..."]
  }
}
```

If a source fails, its section carries an `error` and `risk.reasons` says "unknown" for it; those failures are not counted as risk.

How the score is built: newly registered (30 days or less) +40; 31-90 days old +20; no RDAP record for the exact name +10; resolves to private IPs +50; no A/AAAA +15; no SPF +5; no DMARC +5; no certificates in CT logs +10; latest CT certificate not currently valid +25; off-domain redirect +10. `suspicious` is true at 35 or more, or when newly registered, or on private IPs.

## Data sources and licence

IANA RDAP bootstrap and the registry's RDAP server (public registration data), Cloudflare DNS-over-HTTPS, and crt.sh (public Certificate Transparency search run by Sectigo). Each has its own terms; crt.sh has no SLA and may be slow or unavailable. Some country-code TLDs have no RDAP, so registration data is missing for them.

## Freshness and caching

Domain results are not cached; each call queries the sources live (only the IANA bootstrap list is cached, for 6 hours). `queriedAt` is the time of the lookup. CT data covers unexpired certificates for the exact name.

## Limits

- Heuristic, not a verdict; no reputation or content checks.
- Exact-name lookups (no public-suffix handling).
- crt.sh and some RDAP registries rate-limit and can be slow (RDAP up to 12 s, crt.sh up to 10 s).
- No live TLS handshake (certificate data comes from CT logs).