get_domain
Returns the complete surveillance intelligence record for a domain name. If the domain is in TunnelMind's tracker database (80,000+ entries), the response includes tracker category, risk score, fingerprinting data, cookie persistence, IAB TCF purposes, and the owning corporate entity. If the domain is not in the database, a live probe is automatically run: RDAP registration data, DNS records (MX, SPF, TXT verification tokens), HTTP headers, and CSP third-party actors are fetched fresh from the edge and returned.
Use this tool when:
You need to know whether a specific domain tracks users, and how aggressively.
You are researching who owns a domain and what corporate entity controls it.
You want to check HTTP security headers and third-party services embedded in a site.
You are building a risk score for a domain before routing traffic through it.
Do NOT use this tool when:
You want to search by keyword or category — use
searchinstead.You want all domains for an entity — use
get_entityinstead.
Inputs:
domain(path, required): Domain name. Stripwww.prefix — it is removed automatically. Subdomains are resolved to the parent:ads.doubleclick.net→doubleclick.net. Examples:doubleclick.net,google-analytics.com,intercom.io.
Returns:
Full
DomainRecord. Free tier returns the domain, category, score, prevalence, and entity name. Pro/enterprise additionally returntcf_vendor_id,tcf_purposes,tcf_features, anddisconnect_cats.If the domain is not in the tracker database,
live_lookup: trueis set and RDAP/DNS/HTTP probe results are returned instead of tracker fields.404 if the domain cannot be found via live probe either (unknown TLD, unreachable).
Cost:
Free tier: included in 50 req/day limit. Pro/enterprise: included in plan.
Latency:
Database hit: typical <100ms, p99 <300ms.
Live probe: typical 2-5s, p99 10s (external DNS/HTTP calls).
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| domain | Yes | Domain name to look up (www. prefix stripped automatically) |