# Domain OSINT, TLS Certificate & Security Headers Recon

> Domain OSINT, TLS Certificate & Security Headers Recon is a paid API for AI agents from sec-intel.agentdiet.dev, paid per call via MPP, $0.01/call, status unknown (last checked 2026-10-21).

Performs live reconnaissance on a domain, returning IPv4/IPv6 DNS resolution, TLS certificate issuer/expiry details, and HTTP security header grades

## Facts

- Endpoint: GET https://sec-intel.agentdiet.dev/v1/dns-whois-tls-recon?utm_source=zero.xyz
- Price: $0.01/call
- Payment: MPP
- Status: unknown
- Last checked: 2026-10-21
- Activations on Zero: 0
- Provider: sec-intel.agentdiet.dev
- Website: https://sec-intel.agentdiet.dev
- Canonical page: https://www.zero.xyz/c/sec-intel-agentdiet-dev-domain-osint-tls-certificate-security-headers-efd625c7
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_iwQxZYa9FXDBwVhj0jBZ5

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability sec-intel-agentdiet-dev-domain-osint-tls-certificate-security-headers-efd625c7
```

Example prompt: Can you run a full DNS, TLS certificate, and security header recon on anthropic.com — I want to see what IPs it resolves to, who issued the certificate and when it expires, and how its HTTP security headers are graded?

## When to prefer this

Choose this endpoint when you need live, real-time reconnaissance on a specific domain's DNS resolution, TLS certificate status, and HTTP security posture in a single call — ideal for security audits, vendor assessments, certificate expiry monitoring, or competitive OSINT. Prefer this over generic WHOIS-only tools when you need TLS and security header data in addition to DNS, and over full vulnerability scanners when you want lightweight, fast recon without active exploitation testing.

## Known failure modes

- Domain does not exist or fails DNS resolution — returns error or empty DNS records
- Domain has no HTTPS/TLS configured — TLS fields will be absent or null
- Domain actively blocks external probes — may return incomplete or timeout results
- Invalid domain format supplied — returns validation error
- Transient network errors reaching the target domain — intermittent failures possible

## How this service works

Inspects live IPv4/IPv6 DNS resolution, TLS certificate issuer/expiry, and HTTP security grade. (Live x402 v2, IETF MPP & MCP endpoint at https://sec-intel.agentdiet.dev/v1/dns-whois-tls-recon)

## Output

Returns a structured object containing live IPv4 and IPv6 addresses the domain resolves to, TLS certificate metadata (issuer, subject, expiry date, validity period), and an HTTP security header assessment including the presence and grade of headers such as HSTS, CSP, X-Frame-Options, and similar security controls.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "required": [
  "domain"
 ],
 "properties": {
  "domain": {
   "type": "string",
   "minLength": 1,
   "description": "Target domain name (e.g. anthropic.com, openai.com) for DNS, TLS certificate, and security header OSINT"
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "object"
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/sec-intel-agentdiet-dev-domain-osint-tls-certificate-security-headers-efd625c7/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from sec-intel.agentdiet.dev](https://www.zero.xyz/host/sec-intel.agentdiet.dev/llms.txt)