# AgentStall ZA Email Security Checker

> AgentStall ZA Email Security Checker is a paid API for AI agents from agentstall.nilesh-b54.workers.dev, paid per call via x402, $0.003/call, status unknown (last checked 2026-11-02).

Checks a South African domain's email security configuration (DMARC, MTA-STS, SPF) and returns a grade, score, and spoofing-risk assessment, or a sector-wide scorecard.

## Facts

- Endpoint: GET https://agentstall.nilesh-b54.workers.dev/v1/email-security?utm_source=zero.xyz
- Price: $0.003/call
- Payment: x402
- Status: unknown
- Last checked: 2026-11-02
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/agentstall-za-email-security-checker-ff57c77f
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_dXSXj3tykBxsFBUlCZEJN

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability agentstall-za-email-security-checker-ff57c77f
```

Example prompt: Can you check the email security grade for fnb.co.za — I want to know if it can be spoofed and what DMARC policy it has?

## When to prefer this

Choose this endpoint when you need to assess email spoofing risk, DMARC configuration, or overall email security posture for South African domains (.co.za and others). It uniquely offers sector-level scorecards for South African banks, insurers, government, metros, telecoms, and regulators — making it ideal for compliance audits, threat intelligence, and supplier vetting in a South African context. Use it over generic DMARC checkers when you need structured, graded output with spoofing-risk language or sector benchmarking.

## Known failure modes

- Domain not found or does not exist — returns empty or error result
- No DNS records present for the domain — minimal findings returned
- Payment not made — returns HTTP 402 with PAYMENT-REQUIRED header
- Invalid sector value — returns error indicating valid sector options
- Domain parameter missing without sector — returns validation error
- Rate limiting or upstream DNS timeout — may return partial results

## How this service works

Email security and spoofing check for any domain: grades DMARC, SPF, DNSSEC, MTA-STS and TLS-RPT from public DNS and says how easily fake email could be sent in the domain's name. Alternatively returns daily-updated scorecards ranking banks, government bodies, regulators and telecoms in South Africa, Nigeria, Kenya, Egypt, Ghana and 6 other African countries.

## Output

Returns a JSON object containing the domain checked, an overall email security grade (e.g. A–F), a numeric score (0–100), the DMARC policy in effect (none/quarantine/reject), a spoofing difficulty assessment (e.g. 'harder (lands in spam)'), and a list of specific security findings such as missing MTA-STS or weak DMARC configuration. For sector queries, returns an aggregated scorecard across multiple domains.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "required": [],
     "properties": {
      "domain": {
       "type": "string",
       "description": "Domain to check, e.g. example.co.za (use this or sector)"
      },
      "sector": {
       "type": "string",
       "description": "Leave empty when checking a domain. For a ranked scorecard instead, give a sector: banks_insurers, government, metros, regulators_soe, telecoms, all (e.g. banks_insurers)"
      },
      "country": {
       "type": "string",
       "description": "Scorecard only: ZA (default), NG, KE, EG, GH, MA, RW, UG, TZ, MU, BW, or ALL"
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "dmarc": {
   "policy": "quarantine"
  },
  "grade": "B",
  "score": 75,
  "domain": "example.co.za",
  "findings": [
   "no MTA-STS: incoming mail encryption can be downgraded"
  ],
  "spoofing": "harder (lands in spam)"
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/agentstall-za-email-security-checker-ff57c77f/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from agentstall.nilesh-b54.workers.dev](https://www.zero.xyz/host/agentstall.nilesh-b54.workers.dev/llms.txt)