Domain Intel

Use this for passive infrastructure questions about domains: DNS records, TLS expiry, WHOIS, subdomains from certificate transparency, and registration/availability signals.

This is not a vulnerability scan. Do not port scan or send exploit payloads under this skill.

Quick Checks

DNS:

dig A example.com +short
dig AAAA example.com +short
dig MX example.com +short
dig TXT example.com +short
dig NS example.com +short

TLS certificate:

echo | openssl s_client -servername example.com -connect example.com:443 2>/dev/null \
  | openssl x509 -noout -subject -issuer -dates -ext subjectAltName

WHOIS:

whois example.com | sed -n '1,120p'

Certificate Transparency:

python3 - <<'PY'
import json, sys, urllib.parse, urllib.request
domain = sys.argv[1] if len(sys.argv) > 1 else "example.com"
url = "https://crt.sh/?" + urllib.parse.urlencode({"q": f"%.{domain}", "output": "json"})
with urllib.request.urlopen(url, timeout=20) as res:
    rows = json.load(res)
names = sorted({name.strip().lower() for row in rows for name in row.get("name_value", "").splitlines() if name.strip().endswith(domain)})
for name in names[:200]:
    print(name)
print(f"total={len(names)}", file=sys.stderr)
PY example.com

Output

Report:

• Domain and exact query time.
• A/AAAA/MX/NS/TXT summary.
• TLS issuer, subject, SAN highlights, and expiry.
• WHOIS registrar and important dates when available.
• CT-derived subdomains, clearly labeled as historical/passive.
• Confidence and limitations.

Caveats

• WHOIS is frequently redacted.
• CT logs include stale and third-party issued names.
• DNS answers vary by resolver and geography.
• Availability checks are heuristics; registrar APIs are authoritative.