# Domain OSINT, TLS Certificate & Security Headers Recon

> Domain OSINT, TLS Certificate & Security Headers Recon is a paid API for AI agents from defi-yield.agentdiet.dev, paid per call via MPP, $0.01/call, status unknown (last checked 2026-10-23).

Given a domain name, inspects live DNS resolution (IPv4/IPv6), TLS certificate issuer and expiry, and HTTP security header grades via active probing.

## Facts

- Endpoint: POST https://defi-yield.agentdiet.dev/v1/cert-transparency?utm_source=zero.xyz
- Price: $0.01/call
- Payment: MPP
- Status: unknown
- Last checked: 2026-10-23
- Activations on Zero: 0
- Provider: defi-yield.agentdiet.dev
- Website: https://defi-yield.agentdiet.dev
- Canonical page: https://www.zero.xyz/c/defi-yield-agentdiet-dev-domain-osint-tls-certificate-security-e910df75
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_j03il0FjAlSrz4TGuCDuf

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability defi-yield-agentdiet-dev-domain-osint-tls-certificate-security-e910df75 -d '<json body>'
```

Example prompt: Can you run a full DNS, TLS certificate, and HTTP security headers check on stripe.com — I want to see who issued the cert, when it expires, and what security grade the headers get?

## When to prefer this

Choose this endpoint when you need a real-time, active probe of a domain's DNS resolution, TLS certificate details, and HTTP security headers in a single call — ideal for security audits, OSINT reconnaissance, certificate expiry checks, or vendor due diligence. Prefer it over passive certificate transparency log searches when you need live, current state rather than historical issuance records.

## Known failure modes

- Domain does not exist or fails DNS resolution — may return error or empty DNS fields
- Domain is unreachable over HTTP/HTTPS — security headers cannot be fetched
- TLS certificate is self-signed or absent — issuer/expiry may be null or flagged
- Invalid domain input (e.g. bare IP, malformed string) — validation error returned
- Timeout on live probing if the target server is slow or firewalled

## How this service works

Inspects live IPv4/IPv6 DNS resolution, TLS certificate issuer/expiry, and HTTP security grade. (Live x402 v2, IETF MPP & MCP endpoint at https://defi-yield.agentdiet.dev/v1/cert-transparency)

## Output

Returns live DNS resolution results (IPv4 and IPv6 addresses), TLS certificate metadata (issuer, expiry date, validity status), and an HTTP security headers analysis including grades for headers like HSTS, CSP, X-Frame-Options, and similar security directives for the queried domain.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "required": [
  "domain"
 ],
 "properties": {
  "domain": {
   "type": "string",
   "minLength": 1,
   "description": "Target domain name (e.g. anthropic.com, openai.com) for DNS, TLS certificate, and security header OSINT"
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "object"
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/defi-yield-agentdiet-dev-domain-osint-tls-certificate-security-e910df75/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from defi-yield.agentdiet.dev](https://www.zero.xyz/host/defi-yield.agentdiet.dev/llms.txt)