# CommsHarbor Email Security Audit

> CommsHarbor Email Security Audit is a paid API for AI agents from commsharbor.com, paid per call via x402, $0.01/call, status unknown (last checked 2026-10-30).

Performs a comprehensive email security audit of a domain, checking SPF, DKIM, DMARC, and MX records and returning an overall security score

## Facts

- Endpoint: GET https://commsharbor.com/api/x402/email-check?utm_source=zero.xyz
- Price: $0.01/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-30
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/commsharbor-email-security-audit-37ba0e6a
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_RVLH77hD_YDDA4wTfc19F

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability commsharbor-email-security-audit-37ba0e6a
```

Example prompt: Can you run a full email security audit on stripe.com — I want to see its SPF, DKIM, DMARC, and MX records along with an overall security score?

## When to prefer this

Choose this endpoint when you need a quick, pay-per-call email security posture check covering all four major email authentication standards (SPF, DKIM, DMARC, MX) with an aggregated score, especially in agentic workflows where you want to avoid subscription overhead and just pay $0.01 per domain checked.

## Known failure modes

- Invalid or non-existent domain returns an error or empty results
- Subdomain input is automatically reduced to the registrable domain, which may differ from user expectation
- DNS lookup failures for domains with propagation issues may return incomplete results
- Payment not processed results in HTTP 402 rejection before the check runs

## How this service works

CommsHarbor: email security audit of a domain (SPF, DKIM, DMARC, MX and a score), paid per call

## Output

Returns the results of SPF, DKIM, DMARC, and MX record checks for the requested domain along with an aggregated email security score, indicating which email authentication standards are properly configured, missing, or misconfigured.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method",
    "queryParams"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "required": [
      "domain"
     ],
     "properties": {
      "domain": {
       "type": "string",
       "description": "Public domain to check, such as example.com. A subdomain or URL is reduced to its registrable domain."
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object",
     "properties": {
      "mx": {
       "type": "array",
       "items": {
        "type": "string"
       },
       "description": "MX records as `priority host`."
      },
      "spf": {
       "type": "object",
       "properties": {
        "ending": {
         "type": "string"
        },
        "record": {
         "type": "string"
        },
        "multiple": {
         "type": "boolean"
        }
       },
       "description": "`{record, ending, multiple}`: the first SPF record, its `all` ending and whether there are two."
      },
      "bimi": {
       "type": "boolean",
       "description": "A BIMI record exists at the default selector."
      },
      "dkim": {
       "type": "object",
       "properties": {
        "found": {
         "type": "array"
        },
        "checked": {
         "type": "array",
         "items": {
          "type": "string"
         }
        }
       },
       "description": "`{found, checked}`: selectors with a published key and the selectors looked up."
      },
      "dmarc": {
       "type": "object",
       "properties": {
        "policy": {
         "type": "string"
        },
        "record": {
         "type": "string"
        },
        "reports": {
         "type": "boolean"
        }
       },
       "description": "`{record, policy, reports}`: policy reject, quarantine, none or null; reports when `rua` is set."
      },
      "score": {
       "type": "number",
       "description": "0 to 100: DMARC up to 40, SPF 20, DKIM 20, MX 10, MTA-STS 5 and BIMI 5."
      },
      "domain": {
       "type": "string",

… (truncated)
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/commsharbor-email-security-audit-37ba0e6a/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from commsharbor.com](https://www.zero.xyz/host/commsharbor.com/llms.txt)