# Email Auth Check (SPF, DMARC, DKIM, MX)

> Email Auth Check (SPF, DMARC, DKIM, MX) is a paid API for AI agents from agent-data.centorprat.workers.dev, paid per call via x402, $0.01/call, status unknown (last checked 2026-10-29).

Checks SPF, DMARC, DKIM, and MX DNS records for given domains via DNS-over-HTTPS and returns an anti-spoofing posture signal per domain.

## Facts

- Endpoint: POST https://agent-data.centorprat.workers.dev/tools/email-auth-dmarc-spf-check?utm_source=zero.xyz
- Price: $0.01/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-29
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/email-auth-check-spf-dmarc-dkim-mx-8cbe1d7c
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_aAgrcyCE3-f5j5ZwzEz3R

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability email-auth-check-spf-dmarc-dkim-mx-8cbe1d7c -d '<json body>'
```

Example prompt: Can you check the email authentication posture for hubspot.com and mailchimp.com — specifically their SPF, DMARC, DKIM, and MX records — and tell me if either domain is spoofable?

## When to prefer this

Choose this endpoint when you need a fast, keyless, read-only audit of email authentication records (SPF, DMARC, DKIM, MX) without managing DNS resolver credentials. Ideal for agents that need to assess anti-spoofing posture programmatically, run scheduled domain health checks, or flag spoofable domains in a brand protection workflow. Prefer over manual DNS lookups when you want a structured posture signal rather than raw record strings.

## Known failure modes

- DNS lookup failure for a record type — returns partial results without charging for the failed lookup
- Invalid or non-existent domain — returns no-email-configured or error finding
- Exceeding maxItems (3 domains per call) — input rejected by schema validation
- DKIM selector not found — selector-specific lookup returns not-found finding; add custom selectors if using non-standard ones
- Transient DNS-over-HTTPS connectivity issue — call fails or returns incomplete results

## How this service works

Pay-per-call data and tools for AI agents, $0.002-0.01 per call in USDC via x402 (Base, Polygon or Solana), no account or API key; MAX tiers ($0.05-0.25) run deeper jobs. Agent toolkit: web search, search + read top pages, any page as clean markdown with a prompt-injection check, which-x402-API-to-call recommender, seller check. Data: Google Maps places with contacts, YouTube video data and transcripts, job listings (Indeed, LinkedIn, 13 boards), Google Ads Transparency, TikTok comments, Pinterest, Airbnb, Redfin, AliExpress, app stores, live sports, website and SEO checks, Shopify store tech stacks, and onchain token / address risk checks.

## Output

Returns one posture report per domain containing: the posture signal (protected / mostly-protected / monitoring-only / spoofable / no-email-configured), detailed findings for each of SPF, DMARC, DKIM (per checked selector), and MX records, including parsed record values and any identified weaknesses or misconfigurations.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "domains": {
   "type": "array",
   "items": {
    "type": "string"
   },
   "maxItems": 3,
   "description": "Domains to check, e.g. [\"example.com\", \"your-brand.org\"]. One posture report per domain."
  },
  "onlyProblems": {
   "type": "boolean",
   "description": "On: return only domains that aren't fully protected (ideal for scheduled alerting)."
  },
  "dkimSelectors": {
   "type": "array",
   "items": {
    "type": "string"
   },
   "maxItems": 5,
   "description": "Which DKIM selectors to check at <selector>._domainkey.<domain>. Defaults to a set of common selectors (google, default, selector1/2, s1/2, k1, ...). Add your own if you use a custom selector."
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "items": [
   {
    "spf": {
     "issues": [],
     "record": "v=spf1 ip4:198.2.180.60/32 ip4:13.111.2.227/32 include:spf1.stripe.com include:greenhouse-outbound-mail.stripe.com include:_spf.qualtrics.com ~all",
     "present": true,
     "lookupCount": 3,
     "allQualifier": "~all"
    },
    "dkim": {
     "present": true,
     "selectorsFound": [
      "google",
      "s1",
      "s2",
      "mandrill"
     ],
     "selectorsChecked": 15
    },
    "note": "Read-only DNS lookups over DoH; never contacts the domain's mail servers. DKIM is checked against common selectors only - absence here isn't proof DKIM is unused. Signals for review, not a verdict.",
    "dmarc": {
     "pct": "100",
     "rua": "mailto:dmarc-reports@stripe.com",
     "issues": [],
     "policy": "reject",
     "record": "v=DMARC1; p=reject; pct=100; fo=1; rua=mailto:dmarc-reports@stripe.com; ruf=mailto:dmarc-forensics@stripe.com;",
     "present": true,
     "subdomainPolicy": null
    },
    "domain": "stripe.com",
    "signal": "protected",
    "findings": [],
    "checkedAt": "2026-10-23T11:31:48+00:00",
    "mxPresent": true
   }
  ]
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/email-auth-check-spf-dmarc-dkim-mx-8cbe1d7c/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from agent-data.centorprat.workers.dev](https://www.zero.xyz/host/agent-data.centorprat.workers.dev/llms.txt)