# MTA-STS & TLS-RPT Change Watch

> MTA-STS & TLS-RPT Change Watch is a paid API for AI agents from intel.rallylive.ca, paid per call via x402, $0.02/call, status unknown (last checked 2026-09-14).

Monitors a domain's MTA-STS and TLS-RPT configuration by running a check, comparing it to the previous result (retained 90 days), and returning what changed with before/after field values.

## Facts

- Endpoint: GET https://intel.rallylive.ca/watch/email/mta-sts
- Price: $0.02/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-14
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/mta-sts-tls-rpt-change-watch-3e3ee39f
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_5zXELIieXBvKsxQ_gVKhS

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability mta-sts-tls-rpt-change-watch-3e3ee39f
```

Example prompt: Keep an eye on example.com's MTA-STS and TLS-RPT settings — run the check now and tell me if anything has changed since the last time you checked, including exactly which fields are different and what they changed from and to.

## When to prefer this

Choose this endpoint when you need to detect configuration drift in a domain's MTA-STS policy or TLS-RPT reporting address over time, especially in automated or scheduled workflows. It is purpose-built for change detection with 90-day result retention and field-level diffs, making it superior to a plain one-shot MTA-STS check when you need to know *what* changed and *when*. Prefer it for compliance monitoring, post-deployment verification, or alerting pipelines focused on email security DNS records.

## Known failure modes

- Domain not provided or malformed — likely returns a 400 or validation error
- Domain has no MTA-STS or TLS-RPT records — returns current empty/missing result with no diff if unchanged
- First-ever call for a domain — no previous result to compare, so 'changed' may be indeterminate or treated as new
- Payment not processed — returns 402 Payment Required
- Network timeout reaching the domain's DNS or policy server — may return an error or partial result

## How this service works

Change watch for mta sts tlsrpt check: runs the check and compares it with the result from your previous call for the same domain (kept 90 days), returning the current answer, changed true/false, exactly which fields changed with before/after values, and when it was last seen. Call it on a schedule to be told when mta-sts and tls-rpt check for a domain changes. $0.01 per check.

## Output

Returns the current MTA-STS and TLS-RPT check result for the domain, a boolean 'changed' flag, a field-level diff showing exactly which fields changed with before and after values, and the timestamp of when the result was last seen. Previous results are retained for 90 days for comparison.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "properties": {}
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/mta-sts-tls-rpt-change-watch-3e3ee39f/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from intel.rallylive.ca](https://www.zero.xyz/host/intel.rallylive.ca/llms.txt)