# Domain Intel

> Domain in, full public profile out. Pay per call in USDC over x402. No signup, no API key, no dashboard.

## What this is

A machine facing API for agents that need to judge a domain: domain traders checking whether a name is free and
when it expires, security agents checking mail policy, certificate health and the subdomain surface, SEO agents
checking who runs the DNS and the mailboxes. Payment happens inside the request: call the endpoint, receive
HTTP 402 with the accepted terms, retry with a signed payment header.

## Endpoints

- POST https://dns.netzhandwerker.de/domain — 0.003 USDC — Full domain profile: WHOIS, DNS records, mail setup, TLS certificate, subdomains and registrability in one paid call.

## What one call returns

- WHOIS: registrar, creation date, expiry date, days until expiry, status codes, registry nameservers, DNSSEC flag.
- DNS: A, AAAA, CNAME, MX with priority, NS, TXT, CAA, SOA.
- Mail: MX presence, provider, SPF record with parsed policy, DMARC record with parsed policy, probed DKIM selectors, MTA-STS.
- TLS: issuer, subject, validity window, days remaining, protocol, cipher, trust result, SAN list, optionally the full chain.
- Subdomains: names from Certificate Transparency (crt.sh) merged with the certificate SAN list.
- Operators: nameserver operator and mail provider, derived from the host names.
- Availability: whether the registry still has the name free.

## Optional switches

- `subdomains` (default true) — Certificate Transparency lookup.
- `cert_chain` (default false) — full certificate chain instead of only the leaf.
- `whois_raw` (default false) — unparsed WHOIS text of the registry answer.

## Discovery without payment

- https://dns.netzhandwerker.de/openapi.json
- https://dns.netzhandwerker.de/.well-known/x402
- https://dns.netzhandwerker.de/mcp (Model Context Protocol, tools/list needs no payment)
- https://dns.netzhandwerker.de/pricing
- https://dns.netzhandwerker.de/health
- https://dns.netzhandwerker.de/readiness

## Rules we follow

- WHOIS query budgets are respected per TLD: one lane per registry, a minimum gap between queries, one referral hop at most.
- When a registry throttles or blocks us, the WHOIS fields come back as unknown with a reason. Nothing is guessed and no
  field is filled from a neighbouring source to look complete.
- Availability is only answered from a registry that actually spoke to us, or from an existing DNS delegation.
- DKIM selectors cannot be enumerated. We probe a fixed list and report which of them answered; a silent selector is not
  reported as proof that DKIM is missing.
- A domain profile is cached for 6 hours, the WHOIS record for 24 hours, the Certificate Transparency list for 6 hours.
- Only public data is returned. No port scanning, no content fetching, no attempt to bypass access control.

## Operator

Die Netzhandwerker, IT-Manufaktur für Digitales und Sensorik. https://netzhandwerker.de