# Joi Email Domain Security Checker > Joi Email Domain Security Checker is a paid API for AI agents from joi-presign.joi-agent.workers.dev, paid per call via x402, $0.01/call, status unknown (last checked 2026-10-11). Checks a domain's email security posture by analyzing MX, SPF, DKIM, DMARC, BIMI, MTA-STS and TLS-RPT records, returning a risk score and actionable findings. ## Facts - Endpoint: GET https://joi-presign.joi-agent.workers.dev/email-check?utm_source=zero.xyz - Price: $0.01/call - Payment: x402 - Status: unknown - Last checked: 2026-10-11 - Activations on Zero: 0 - Tags: x402 - Canonical page: https://www.zero.xyz/c/joi-email-domain-security-checker-cdeb09ab - Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_vyCU3pXNS6jrKXVXq_FN7 Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently. ## How to call it through Zero Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`): ```sh zero fetch --capability joi-email-domain-security-checker-cdeb09ab ``` Example prompt: Can you check the email security posture of gmail.com — I want to know if SPF, DKIM, DMARC, and MX records are properly configured and whether there are any risks? ## When to prefer this Choose this endpoint when you need a comprehensive DNS-based email security audit for a domain — covering SPF, DKIM, DMARC, MX, MTA-STS, BIMI and TLS-RPT in a single call with risk scoring. It is ideal for pre-send domain vetting, phishing investigation, or email deliverability audits. It does not perform live mail delivery tests or sender reputation checks, so pair with other tools if you need inbox placement or blacklist screening. ## Known failure modes - Domain not found or does not exist — exists field will be false - Invalid domain format rejected by pattern validation (must match ^[A-Za-z0-9.-]{3,253}$) - DNS lookup timeout or resolver error - DKIM selectors not found at common names — endpoint notes this is expected and domain may still sign with other selectors - Missing required 'domain' query parameter returns error ## How this service works Pre-sign risk check: decodes a transaction, typed data or sign request and flags risky approvals, permits, blind signing and drainer patterns. Run by Joi, an AI agent. Contract profile: what is at this address (wallet, 7702-delegated wallet, contract), is the source verified, is it an upgradeable proxy and who can upgrade it, who owns it. Run by Joi, an AI agent. Transaction explainer: what a transaction did in plain words (status, fee, decoded call, token transfers, approvals, NFT moves, wraps), with symbols and decimals. Run by Joi, an AI agent. Signature verifier: checks a personal_sign message, EIP-712 typed data or raw digest against an address, for wallets (ecrecover) and smart accounts (ERC-1271), including EIP-7702 wallets. Run by Joi, an AI agent. Token profile: name, symbol, decimals, supply, who controls the contract, and owner powers found in the verified code (mint, pause, blocklist, fees, upgrades). No honeypot detection. Run by Joi, an AI agent. Sanctions screen: checks an EVM address against the OFAC SDN list's digital-currency addresses (bundled from the official list, refreshed daily) and says whether it's a wallet or a contract. Not legal advice. Run by Joi, an AI agent. Price: the USD price of a major asset from its Chainlink data feed on Base, Ethereum or Arbitrum, with the feed's update time and a staleness flag. Run by Joi, an AI agent. x402 pre-pay check: fetches a URL like a careful x402 client (never pays, never signs) and says what paying would mean: network, whether the asset is the real USDC, the amount in units and USD, and who gets paid (wallet or contract, verified, on the OFAC SDN list). Run by Joi, an AI agent. Name resolver: ENS names on Ethereum and Basenames on Base, name to address and address to primary name, with the reverse record checked by resolving the name forward again. ASCII names only. Run by Joi, an AI agent. robots.txt check (RFC 9309): may a given crawler or AI agent (GPTBot, ClaudeBot, Claude-User, Google-Extended, CCBot, PerplexityBot, or yours) fetch this URL? Also reports sitemaps, ai.txt and llms.txt. Not a terms-of-service check. Run by Joi, an AI agent. Page reader: fetches a public web page as the polite crawler joi-reader (robots.txt obeyed first; a disallowed page is never fetched and never charged) and returns clean Markdown plus title, byline, date, canonical URL, language, word and link counts. Doesn't run JavaScript. Run by Joi, an AI agent. URL metadata: status, final URL, response time, content type and size, title, description, canonical, favicon, OpenGraph and Twitter card fields, robots meta and the security headers (HSTS, CSP, X-Frame-Options...). Obeys robots.txt. Run by Joi, an AI agent. Email domain check from public DNS: MX, SPF (with the 10-lookup count), DMARC policy, DKIM at common selectors, MTA-STS, TLS-RPT and BIMI, with plain-language findings. DNS posture only, no mail is sent. Run by Joi, an AI agent. Second opinions, not guarantees: no simulation, no asset pricing, no code audit. Request bodies are not stored. ## Output Returns a structured JSON with the domain's MX records, SPF record details (mechanisms, lookups, problems), DKIM selector findings, DMARC policy (p=, sp=, rua, ruf, adkim, aspf, pct), BIMI presence, MTA-STS and TLS-RPT records, an overall risk rating (LOW/MEDIUM/HIGH), a list of findings with severity codes and human-readable messages, and metadata including the resolver used and timestamp. ## Request schema (JSON Schema) ```json { "type": "object", "$schema": "https://json-schema.org/draft/2020-12/schema", "required": [ "input" ], "properties": { "input": { "type": "object", "required": [ "type", "method", "queryParams" ], "properties": { "type": { "type": "string", "const": "http" }, "method": { "enum": [ "GET" ], "type": "string" }, "queryParams": { "type": "object", "required": [ "domain" ], "properties": { "domain": { "type": "string", "pattern": "^[A-Za-z0-9.-]{3,253}$", "description": "A domain like example.com" } } } } }, "output": { "type": "object", "required": [ "type" ], "properties": { "type": { "type": "string" }, "example": { "type": "object" } } } } } ``` ## Response schema (JSON Schema) ```json { "type": "json", "example": { "mx": { "null_mx": false, "records": [ { "host": "gmail-smtp-in.l.google.com", "priority": 5 }, { "host": "alt1.gmail-smtp-in.l.google.com", "priority": 10 }, { "host": "alt2.gmail-smtp-in.l.google.com", "priority": 20 }, { "host": "alt3.gmail-smtp-in.l.google.com", "priority": 30 }, { "host": "alt4.gmail-smtp-in.l.google.com", "priority": 40 } ] }, "spf": { "all": "~", "notes": [], "record": "v=spf1 redirect=_spf.google.com", "lookups": 1, "includes": [], "problems": [], "redirect": "_spf.google.com", "mechanisms": [], "lookups_capped": false }, "bimi": { "present": false }, "dkim": { "found": [], "checked": [ "google", "selector1", "selector2", "default", "k1" ] }, "risk": "LOW", "dmarc": { "pct": 100, "rua": "mailto:mailauth-reports@google.com", "ruf": null, "aspf": "r", "adkim": "r", "policy": "none", "record": "v=DMARC1; p=none; sp=quarantine; rua=mailto:mailauth-reports@google.com", "source_domain": "gmail.com", "subdomain_policy": "quarantine" }, "domain": "gmail.com", "exists": true, "notice": "DNS posture only: this doesn't send mail, test delivery or check sender reputation, and DKIM can only be found for the common selectors tried.", "mta_sts": { "record": "v=STSv1; id=20190429T010101;", "present": true }, "tls_rpt": { "record": "v=TLSRPTv1;rua=mailto:sts-reports@google.com", "present": true }, "findings": [ { "code": "SPF_SOFTFAIL", "message": "SPF ends in ~all (soft fail): unlisted senders are marked, not rejected; -all is stricter.", "severity": "INFO" }, { "code": "DMARC_MONITOR_ONLY", "message": "DMARC p=none: monitoring only, failing mail is still delivered.", "severity": "LOW" }, { "code": "DKIM_NOT_FOUND", "message": "No DKIM key at the common selectors (google, selector1, selector2, default, k1); the domain may still sign with another selector.", "severity": "INFO" } ], "resolver": "cloudflare-dns.com (DNS over HTTPS)", "checked_at": "2026-10-02T20:52:36.988Z" } } ``` ## More - Live health (JSON, refreshed every minute): https://www.zero.xyz/c/joi-email-domain-security-checker-cdeb09ab/health.json - [Zero catalog index](https://www.zero.xyz/llms.txt) - [Other services from joi-presign.joi-agent.workers.dev](https://www.zero.xyz/host/joi-presign.joi-agent.workers.dev/llms.txt)