# Domain Intel — WHOIS, DNS, TLS & Subdomain Lookup (x402)

> Domain Intel — WHOIS, DNS, TLS & Subdomain Lookup (x402) is a paid API for AI agents from dns.halowerk.com, paid per call via x402, $0.009/call, status unknown (last checked 2026-10-13).

Given a domain name, returns WHOIS registration data, DNS records, mail policy (SPF/DKIM/DMARC), TLS certificate details, and subdomain enumeration — paid per call in USDC via x402.

## Facts

- Endpoint: POST https://dns.halowerk.com/domain/articles/ns-desec?utm_source=zero.xyz
- Price: $0.009/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-13
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/domain-intel-whois-dns-tls-subdomain-lookup-x402-3d541082
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_YEnsar7kqyB6GDVhtAiTA

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability domain-intel-whois-dns-tls-subdomain-lookup-x402-3d541082 -d '<json body>'
```

Example prompt: Look up full domain intelligence for example.com — I need WHOIS registration info, all DNS records, mail policy (SPF, DKIM, DMARC), TLS certificate details, and any known subdomains.

## When to prefer this

Choose this endpoint when you need comprehensive, multi-signal domain intelligence in a single call without API key signup — especially useful for ad-hoc security investigations, domain audits, or automated enrichment pipelines. The optional baseline parameter enables change-detection use cases by comparing current records against a previously observed snapshot. Prefer this over single-purpose WHOIS or DNS tools when you need WHOIS + DNS + mail policy + TLS + subdomains all at once. The pay-per-call x402 micropayment model makes it ideal for low-volume or bursty agent workflows with no subscription overhead.

## Known failure modes

- Domain not found or unresolvable — returns empty or error response
- WHOIS data unavailable for certain TLDs or privacy-protected registrations
- Payment fails or x402 authorization not accepted — request rejected before processing
- Rate limiting or upstream DNS resolver failures cause partial results
- Malformed domain input (exceeds 253 chars or invalid format) — validation error

## How this service works

Domain in, WHOIS, DNS, mail policy, TLS certificate and subdomains out. Pay per call in USDC over x402. No signup, no API key.

## Output

Returns a structured report containing: WHOIS registration metadata (registrar, creation/expiry dates, registrant info), full DNS record set (A, AAAA, MX, NS, TXT, CNAME, etc.), mail security policy records (SPF, DKIM, DMARC), TLS certificate chain details (issuer, validity, SANs), and an enumerated list of discovered subdomains.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "domain": {
   "type": "string",
   "maxLength": 253
  },
  "baseline": {
   "type": "object",
   "required": [
    "domain",
    "observed_at",
    "records"
   ],
   "properties": {
    "domain": {
     "type": "string",
     "maxLength": 253
    },
    "records": {
     "type": "array",
     "items": {
      "type": "string",
      "maxLength": 254
     },
     "maxItems": 50
    },
    "observed_at": {
     "type": "string",
     "maxLength": 40
    }
   },
   "additionalProperties": false
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/domain-intel-whois-dns-tls-subdomain-lookup-x402-3d541082/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from dns.halowerk.com](https://www.zero.xyz/host/dns.halowerk.com/llms.txt)