Domain Report
domain_reportQuery DNS records, WHOIS data, SSL certificate, subdomains, and threat intelligence for a domain. Returns risk score, email security posture, and recommendations.
Instructions
Query DNS, WHOIS, SSL, subdomains, and threat intel for a domain in one call. By default dns.txt is filtered to security-relevant entries (SPF, DMARC, DKIM, MTA-STS, TLS-RPT) and dns.total_txt_records reports the honest pre-filter count; pass include_all_txt=true for the raw TXT list. Use as a starting point for domain investigations; use audit_domain for live headers + tech stack. Response carries next_calls — chain with subdomain_enum (always emitted), ssl_check + tech_fingerprint (when an A record resolves) for the standard recon depth without re-prompting. Free: 30/hr, Pro: 500/hr. Returns domain report with DNS records, WHOIS data, SSL cert, risk score, email config, threat status, recommendation, and next_calls.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| domain | Yes | Root domain to analyze, without protocol or path (e.g. 'example.com', 'shopify.com') | |
| include_all_txt | No | Return every TXT record (default: False, only SPF/DMARC/DKIM/MTA-STS/TLS-RPT kept). dns.total_txt_records is always emitted with the honest pre-filter count. Default filter strips vendor verification strings (google-site-verification, ms=, facebook-domain-verification, etc.) that bloat the response without security signal. Set True only when you need the raw TXT inventory. |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |