# Agent402 Domain Security Audit

> Agent402 Domain Security Audit is a paid API for AI agents from agent402.tools, paid per call via x402, $0.6/call, status unknown (last checked 2026-09-14).

Performs a comprehensive security audit of a domain, scoring email authentication (SPF/DKIM/DMARC), TLS/HTTPS configuration, and HTTP security headers, then returns a graded report with actionable findings.

## Facts

- Endpoint: POST https://agent402.tools/v1/domain-audit
- Price: $0.6/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-14
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/agent402-domain-security-audit-f31d2478
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_3n1IqZLvh2OaukzXA_7g2

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability agent402-domain-security-audit-f31d2478 -d '<json body>'
```

Example prompt: Can you run a full domain security audit on stripe.com and give me the report in markdown — I want to see the grade, email auth scores, and TLS status?

## When to prefer this

Choose this endpoint when you need an automated, graded security audit of a public domain covering email authentication (SPF/DKIM/DMARC), HTTP security headers, and TLS certificate status in a single call. It is especially useful for pre-launch reviews, deliverability debugging, compliance checks, or competitive benchmarking. Prefer it over manual DNS lookup tools when you want a synthesized, letter-graded report rather than raw DNS record data.

## Known failure modes

- Invalid or non-existent domain returns an error or partial results
- Private/internal domains (e.g. localhost, intranet) may not resolve and will fail
- Domains with aggressive rate limiting may return incomplete DNS lookup results
- Malformed URL input may fail parsing before audit begins
- TLS lookup failures if the domain has no HTTPS endpoint

## How this service works

Hand over a domain and get one graded security & email-deliverability audit: SPF, DMARC, DKIM and MX (why your mail lands in spam), the web security headers, and the TLS certificate - every finding from a live probe, with an overall letter grade, a downloadable checks appendix, and a prioritized, specific list of fixes. USDC (x402/MPP) or card (Stripe). Not cached.

## Output

A structured response containing: an overall letter grade (A–F), a composite score (0–100), sub-scores for email authentication and HTTP security headers, TLS days remaining, a detailed breakdown table of SPF/DKIM/DMARC checks with pass/fail status, and either a human-readable markdown report or a JSON object depending on the requested format.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "domain": {
   "type": "string",
   "description": "The domain to audit, e.g. example.com (also accepts a URL or host)."
  },
  "format": {
   "enum": [
    "markdown",
    "json"
   ],
   "type": "string",
   "description": "Response shape (default markdown report)."
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "meta": {
   "tier": "domain-audit",
   "grade": "B",
   "domain": "example.com",
   "composite": 82,
   "email_score": 90,
   "header_score": 70,
   "synthesis_model": "anthropic/claude-opus-5",
   "tls_days_remaining": 204
  },
  "grade": "B",
  "domain": "example.com",
  "report": "# Domain Security Audit: example.com\n\n**Overall grade: B** (82/100)\n\n## Overall grade\n...",
  "tables": [
   {
    "name": "email-checks",
    "rows": [
     [
      "spf",
      "pass",
      "SPF record present, 1 DNS lookup, ~all qualifier"
     ]
    ],
    "label": "Email authentication checks",
    "columns": [
     "Check",
     "Status",
     "Detail"
    ]
   }
  ],
  "sources": [],
  "composite": 82
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/agent402-domain-security-audit-f31d2478/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from agent402.tools](https://www.zero.xyz/host/agent402.tools/llms.txt)