infosec_domain
Check a domain: email deliverability, blocklists, DNS, whois, TLS — op picks the check.
Read-only and passive: DNS-over-HTTPS, RDAP, public CT logs, a TLS handshake, one HTTP GET. No port scan, no vulnerability probing, no key needed.
op :
"deliverability" : full email-deliverability report for YOUR sending domain — SPF/DMARC/DKIM/MTA-STS/TLS-RPT/BIMI + blocklists, a
score/100, agradeandrecommendationssorted by priority. Start here to answer « do our emails land in spam? ». What could not be read (DNS error, time budget) is listed incoverageand NOT scored —coverage.partialsays so. Passipfor a dedicated sending IP anddkim_selectorif the domain signs with a custom selector."blocklist" : is the domain or a sending IPv4 on a spam blocklist (DNSBL)? Domain lists + IP lists (SpamCop, PSBL, NordSpam, s5h — lists whose terms allow automated commercial lookups), with reverse DNS of each IP. IPs come from
ip, else from the domain's SPFip4:entries. Each list answerslisted/clean/error— anerroris NOT a clean result. ⚠️ Spamhaus, SURBL, URIBL, Barracuda, Mailspike and UCEPROTECT are returned undernot_checked(public resolvers refused, or terms that forbid automated commercial use), never as clean. A domain sending through Google/Microsoft/an emailing tool has no IP of its own to check — the response says so innotes."email_security" : email authentication posture — SPF (record,
allqualifier, DNS lookup count vs the 10 limit), DMARC (policy, sp, pct, rua, alignment), DKIM on common selectors (+dkim_selector), MTA-STS, TLS-RPT, BIMI, MX. ⚠️ DKIM selectors cannot be enumerated: an emptydkim_selectors_founddoes not prove DKIM is absent."whois" : domain registration via RDAP — registrar, creation/expiration dates, statuses, nameservers, registrant org when public.
"dns" : A/AAAA/MX/NS/TXT records, with stack hints (mail provider, SaaS verification tokens).
"subdomains" : known subdomains from Certificate Transparency logs (crt.sh).
count= all distinct found,subdomains= truncated tolimit. crt.sh often fails transiently: the response then carrieserror."tls" : TLS certificate of the host (issuer, validity, SANs, protocol); a failed validation is reported (
validated=false+error), not hidden."headers" : HTTP security headers (HSTS, CSP, …) + server fingerprint.
Tool call template
Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.
{
"id": 1,
"jsonrpc": "2.0",
"method": "tools/call",
"params": {
"arguments": {
"op": "<op>"
},
"name": "infosec_domain"
}
}Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| ip | No | op="blocklist"/"deliverability" — an IPv4 sending address to check. | |
| op | Yes | deliverability | blocklist | email_security | whois | dns | subdomains | tls | headers. | |
| _org | No | Org (id) de CET APPEL. `oto_list_orgs()`. | |
| port | No | op="tls" — TLS port (default 443). | |
| limit | No | op="subdomains" — max distinct subdomains returned (default 100). | |
| _group | No | Équipe (id) de CET APPEL, sous son org parente. | |
| domain | No | a domain, URL or email address (only the domain part is kept). Required except for op="blocklist" with `ip`. | |
| _run_id | No | OBLIGATOIRE à chaque appel dès `run_start` ou `data_claim_next` : sans lui, l'écriture sur une ligne réservée est refusée. Hérité seulement si le serveur tient un run actif — n'y compte pas. | |
| _project | No | Projet (id) de CET APPEL — jeton PRIMAIRE. `oto_project(op='list')`. | |
| _instance | No | Instance de connecteur PRÉCISE (un credential exact). `oto_instance(op='list')`. | |
| dkim_selector | No | op="email_security"/"deliverability" — DKIM selector to test in addition to the common ones. |