domainintel

Domain intelligence from your terminal. One command runs WHOIS, DNS, SSL/TLS, HTTP security headers, blocklist reputation and subdomain discovery against any domain, prints a readable report, and exits non-zero when something's wrong, so it drops straight into CI.

It's the command-line companion to domainintel.app and the DomainIntel MCP server, built on the same analysis engine.

$ domainintel github.com

domainintel • github.com

Security score   A  81/100

WHOIS
────────────
  Registrar  MarkMonitor, Inc.
  Created    2007-10-09
  Expires    2026-10-09 (105 days)
  Privacy    disabled

SSL / TLS certificate
─────────────────────
  Issuer      Sectigo Limited
  Expires in  38 days
  Protocol    TLSv1.3

HTTP security headers
─────────────────────
  Grade  B (72%)
  ✓ strict-transport-security
  ✓ content-security-policy
  ...

✓ No issues detected.

Why

• Runs locally. Queries go straight to the authoritative DNS, WHOIS and TLS endpoints (and crt.sh for subdomains). Nothing is sent to a domainintel.app server. Your lookups stay yours.
• No install required. npx @domainintel/cli example.com.
• Zero runtime dependencies. Ships as a single self-contained bundle.
• Scriptable. --json for piping to jq, meaningful exit codes for CI gates.

Install

# one-off, no install
npx @domainintel/cli example.com

# or install globally for the `domainintel` command
npm install -g @domainintel/cli
domainintel example.com

Requires Node.js 18 or newer.

Usage

domainintel <domain>              Full report (default)
domainintel <command> <domain>    Run a single check

Commands

| Command | What it checks | |---------------|----------------| | full | Everything below, plus an overall A+–F security score (default) | | dns | A, AAAA, MX, TXT, NS, CNAME, CAA records + SPF/DMARC presence + misconfig warnings | | whois | Registrar, creation/expiry/updated dates, privacy status, registrant country | | ssl | TLS certificate: validity, issuer, expiry countdown, protocol, SANs | | headers | HTTP security headers (HSTS, CSP, X-Frame-Options, …) with a letter grade | | reputation | DNSBL and Spamhaus blocklist checks | | subdomains | Subdomain discovery via Certificate Transparency logs |

Options

| Flag | Description | |------|-------------| | --json | Output raw JSON instead of the formatted report (pipeable to jq) | | -e, --exit-code | Exit 1 if the check finds problems (for CI gates) | | --fail-under <days> | (ssl) Exit 1 if the certificate expires within <days> | | --no-color | Disable coloured output (also respects NO_COLOR and non-TTY pipes) | | --debug | Show the underlying analyzer's debug logs on stderr | | -h, --help | Show help | | -v, --version | Show version |

Exit codes

| Code | Meaning | |------|---------| | 0 | Ran successfully; no problems (or --exit-code not set) | | 1 | Ran successfully but found problems (only when --exit-code is set) | | 2 | Could not run: bad usage, invalid domain, or an analysis failure |

Examples

Pipe JSON to jq:

domainintel dns example.com --json | jq '.dns.mx'
domainintel ssl example.com --json | jq '.ssl.daysRemaining'

Gate a deploy on certificate expiry:

# fails the build if the cert expires within 14 days
domainintel ssl yourdomain.com --fail-under 14 --exit-code

Fail if SPF/DMARC are misconfigured:

domainintel dns yourdomain.com --exit-code

Audit a fleet of domains:

cat domains.txt | xargs -I{} domainintel whois {} --json > whois.ndjson

Use in CI

GitHub Actions

Catch an expiring certificate before your users (or your monitoring) do:

name: domain-health
on:
  schedule:
    - cron: '0 6 * * *'   # daily
  workflow_dispatch:

jobs:
  check:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/setup-node@v4
        with:
          node-version: 20
      - name: SSL certificate not expiring within 21 days
        run: npx @domainintel/cli ssl ${{ vars.DOMAIN }} --fail-under 21 --exit-code
      - name: DNS / email auth configured
        run: npx @domainintel/cli dns ${{ vars.DOMAIN }} --exit-code

GitLab CI

domain-health:
  image: node:20
  script:
    - npx @domainintel/cli ssl "$DOMAIN" --fail-under 21 --exit-code

JSON output

--json emits the same structure the MCP server returns. Single checks are wrapped under their key ({ "domain": ..., "dns": {...} }); full returns the complete report including securityScore. Stdout stays clean even for the noisier checks, so it's always safe to pipe.

Related

• domainintel.app — the full web dashboard with PDF export.
• @domainintel/mcp — the same engine as a Model Context Protocol server, so AI agents (Claude, Cursor) can run these checks directly.
• Guides — explainers on DNS, SPF/DMARC, SSL, security headers and more.

License

MIT