# Email Authentication Audit (SPF/DMARC/DKIM/MX) via x402

> Email Authentication Audit (SPF/DMARC/DKIM/MX) via x402 is a paid API for AI agents from agentkit-x402.zenith-ops.workers.dev, paid per call via x402, $0.01/call, status unknown (last checked 2026-10-28).

Performs a comprehensive email authentication audit for a domain, checking MX, SPF, DMARC, DKIM, BIMI, MTA-STS, and TLS-RPT records, and returns a security score with actionable findings.

## Facts

- Endpoint: GET https://agentkit-x402.zenith-ops.workers.dev/v1/email-auth?utm_source=zero.xyz
- Price: $0.01/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-28
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/email-authentication-audit-spf-dmarc-dkim-mx-via-x402-b63cdd43
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_bU2S3VEZbz8uDiFV5BEcj

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability email-authentication-audit-spf-dmarc-dkim-mx-via-x402-b63cdd43
```

Example prompt: Can you audit the email authentication setup for stripe.com — I want to see whether their SPF, DKIM, DMARC, and MX records are properly configured and get an overall security score?

## When to prefer this

Choose this endpoint when you need a comprehensive, multi-record email authentication audit in a single call — covering MX, SPF, DKIM, DMARC, BIMI, MTA-STS, and TLS-RPT together with a scored summary. It requires no API key or signup and charges $0.01 USDC per call via x402 on Base, making it ideal for AI agents with on-chain wallets that need ad-hoc domain audits without managing credentials. Prefer alternatives if you only need a simple DNS lookup (no scoring needed) or if you require email address-level validation rather than domain-level authentication checks.

## Known failure modes

- Domain not found or non-existent — empty or null records returned for all checks
- DNS timeout — individual record checks may return null/not-found
- Invalid domain format (e.g. includes scheme like https://) — query param validation error
- Payment failure via x402 — 402 response if USDC balance is insufficient
- Rate limits on underlying DNS resolvers causing partial results

## How this service works

Pay-per-call API for AI agents with no signup or API key. Email validation, SPF/DMARC audits, DNS lookup, site contacts, URL to Markdown, IBAN and Swedish personnummer/orgnr validation. From $0.001 in USDC on Base via x402.

## Output

Returns a JSON object containing: MX host list with priorities, full SPF record with mechanisms parsed, DMARC record with policy, alignment settings, and RUA/RUF addresses, probed DKIM selectors with key type and bit-length, BIMI/MTA-STS/TLS-RPT presence, an overall integer security score (0–100), and a findings array with severity levels (e.g. medium) and specific fix recommendations.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "required": [
      "domain"
     ],
     "properties": {
      "domain": {
       "type": "string",
       "description": "Domain name without scheme."
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "mx": [
   {
    "host": "mail.example.com",
    "priority": 10
   }
  ],
  "spf": {
   "found": true,
   "record": "v=spf1 include:_spf.example.net -all",
   "mechanisms": [
    "include:_spf.example.net",
    "-all"
   ],
   "all_qualifier": "-",
   "dns_lookups_top_level": 1
  },
  "bimi": {
   "found": false,
   "record": null
  },
  "dkim": {
   "found": [
    {
     "found": true,
     "revoked": false,
     "key_type": "rsa",
     "selector": "google",
     "approx_rsa_bits": 2048
    }
   ],
   "probed_selectors": [
    "google",
    "selector1",
    "selector2",
    "default",
    "k1",
    "s1",
    "mail",
    "dkim"
   ]
  },
  "dmarc": {
   "pct": 100,
   "rua": "mailto:dmarc@example.com",
   "ruf": null,
   "found": true,
   "policy": "none",
   "record": "v=DMARC1; p=none; rua=mailto:dmarc@example.com",
   "spf_alignment": "relaxed",
   "dkim_alignment": "relaxed",
   "subdomain_policy": null
  },
  "score": 75,
  "domain": "example.com",
  "mta_sts": {
   "found": false,
   "record": null
  },
  "tls_rpt": {
   "found": false,
   "record": null
  },
  "findings": [
   {
    "fix": "After reviewing reports, move to p=quarantine and then p=reject.",
    "code": "dmarc_monitoring_only",
    "message": "DMARC policy is p=none (monitoring only); spoofed mail is not blocked.",
    "severity": "medium"
   }
  ]
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/email-authentication-audit-spf-dmarc-dkim-mx-via-x402-b63cdd43/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from agentkit-x402.zenith-ops.workers.dev](https://www.zero.xyz/host/agentkit-x402.zenith-ops.workers.dev/llms.txt)