domain-intel

Collect subdomains, DNS records, WHOIS data, and TLS details for domains.

Updated Apr 9, 2026
One-click install
npx skills add https://github.com/MarbleSodas/Mavis --skill domain-intel-marblesodas
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: domain-intel
Source: https://github.com/MarbleSodas/Mavis/tree/main/optional-skills/research/domain-intel
Command: npx skills add https://github.com/MarbleSodas/Mavis --skill domain-intel-marblesodas

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve?

It helps you quickly gather actionable intelligence about a domain (and its ecosystem) without manually hopping between tools or requiring API keys.

Core Features & Use Cases

  • Subdomain discovery from Certificate Transparency logs to map likely related hosts for a given domain.
  • TLS certificate inspection to understand certificate issuer, SANs, and expiry risk by connecting to port 443.
  • WHOIS and DNS reconnaissance to collect registration signals and DNS records (including MX/NS/TXT/CNAME) with a mix of system DNS and Google DoH.
  • Domain availability checks using passive signals (DNS + WHOIS + SSL reachability) to estimate whether a domain is likely registered.

Quick Start

Ask the AI: run the domain-intel skill in bulk mode for example.com, github.com, and google.com and return JSON containing subdomains, TLS details, WHOIS fields, DNS records, and availability verdicts.

Frequently Asked Questions about domain-intel

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I perform passive domain reconnaissance without using external APIs?

Passive domain reconnaissance without external APIs is executed using Python stdlib to collect subdomains, DNS records, WHOIS data, and TLS certificate details by querying system DNS, Google DoH, port-43 WHOIS, and crt.sh.

How do I check domain availability using DNS and WHOIS signals?

Domain availability is checked by combining passive DNS resolution, port-43 WHOIS registration signals, and port-443 SSL reachability to estimate whether a target domain is currently registered.

How do I find subdomains from Certificate Transparency logs?

Subdomains are discovered by querying Certificate Transparency logs via crt.sh to map likely related hosts and infrastructure for a given target domain.

Can I retrieve DNS records and TLS certificate details using only Python stdlib?

Yes, DNS records including MX, NS, TXT, and CNAME are retrieved via system DNS and Google DoH, while TLS certificate issuer, SANs, and expiry details are inspected by connecting to port 443, all using Python stdlib.

What is the best way to gather WHOIS registration signals for infrastructure due diligence?

WHOIS registration signals are gathered by connecting to port-43 WHOIS services to collect registration data for infrastructure due diligence and pre-onboarding risk assessment.

How do I run bulk domain reconnaissance and output structured JSON results?

Bulk domain reconnaissance is run by passing multiple target domains to the skill, which returns a single JSON structure containing subdomains, TLS details, WHOIS fields, DNS records, and availability verdicts.