# Lookproof SPF Flatten

> Lookproof SPF Flatten is a paid API for AI agents from api.lookproof.dev, paid per call via x402, $0.01/call, status unknown (last checked 2026-10-31).

Unfolds and flattens a domain's full SPF policy into merged IPv4/IPv6 CIDR blocks by recursively following includes and redirects per RFC 7208 lookup limits

## Facts

- Endpoint: GET https://api.lookproof.dev/v1/mail/spf-flatten?utm_source=zero.xyz
- Price: $0.01/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-31
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/lookproof-spf-flatten-b23d8883
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_ElFPmkoPdUv05Y1f_8U5r

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability lookproof-spf-flatten-b23d8883
```

Example prompt: Can you flatten the full SPF policy for stripe.com and show me all the IPv4 and IPv6 blocks that are authorized to send email, including any sources per block and whether it hits the 10-lookup limit?

## When to prefer this

Choose this endpoint when you need a complete, receiver-perspective flattening of an SPF policy into actual IP ranges — especially when debugging lookup limit issues, building firewall allowlists, auditing authorized senders, or verifying RFC 7208 compliance. Prefer this over simple SPF record readers when you need recursive resolution of includes/redirects with CIDR merging and source attribution.

## Known failure modes

- Domain does not exist or has no SPF record — returns error or empty result
- SPF PermError encountered (exceeds 10 DNS lookups or 2 void lookups) — processing stops and error is flagged
- Invalid domain input (malformed string) — validation error
- SPF record has syntax errors — parse failure reported
- Upstream DNS resolution timeout — lookup may fail or return partial results

## How this service works

Check SPF, DMARC, DKIM, MTA-STS, DNSSEC and more, with results that explain what was found and why. Free browser checks and a pay-per-request API with x402.

## Output

A structured response containing merged IPv4 and IPv6 CIDR blocks representing all authorized senders, annotated with the SPF include or mechanism source for each block, separately listed exists/ptr/macro mechanisms, flags for overly broad blocks, lookup counts (DNS and void), and a PermError indicator if RFC 7208 limits are exceeded.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET",
      "HEAD",
      "DELETE"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "title": "DomainInput",
     "required": [
      "domain"
     ],
     "properties": {
      "domain": {
       "type": "string",
       "title": "Domain",
       "examples": [
        "example.com"
       ],
       "maxLength": 1024,
       "minLength": 1
      }
     },
     "additionalProperties": false
    }
   },
   "additionalProperties": false
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/lookproof-spf-flatten-b23d8883/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from api.lookproof.dev](https://www.zero.xyz/host/api.lookproof.dev/llms.txt)