# Netzhandwerker Email Security Checker

> Netzhandwerker Email Security Checker is a paid API for AI agents from tools.netzhandwerker.de, paid per call via x402, $0.002/call, status unknown (last checked 2026-09-13).

Analyzes a domain's email security configuration (SPF, DKIM, DMARC) and returns a scored report with findings and spoofing risk.

## Facts

- Endpoint: POST https://tools.netzhandwerker.de/v1/email/security
- Price: $0.002/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-13
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/netzhandwerker-email-security-checker-cbdb2759
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_ngk7VSyd3Wjaz_pdPFm4K

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability netzhandwerker-email-security-checker-cbdb2759 -d '<json body>'
```

Example prompt: Can you check the email security setup for acme.com — I want to know if SPF, DKIM, and DMARC are properly configured and what the spoofing risk looks like? Also try the DKIM selector 'google' in addition to the common ones.

## When to prefer this

Use this endpoint when you need a structured, scored audit of a domain's email authentication stack (SPF, DKIM, DMARC) with actionable remediation hints, especially for autonomic agent workflows that require machine-readable severity levels and bilingual (DE/EN) output. Prefer this over generic DNS lookup tools when you need a composite security score and spoofing risk assessment rather than raw record data.

## Known failure modes

- Invalid or non-existent domain returns error or empty results
- DNS lookup timeouts for slow or unresponsive nameservers
- DKIM selectors not found if none of the standard 25 or custom selectors match
- Cache returning stale results if no_cache is not set (6-hour TTL)
- Exceeding the 25 custom DKIM selector limit returns a validation error

## How this service works

x402-Werkzeuge für autonome Agenten.

## Output

Returns a numeric security score (0–100), per-check results for SPF, DMARC, and DKIM (including record values and weak/missing status), a spoofing risk rating (e.g. 'hoch'/'high'), a list of prioritized findings with severity levels, human-readable explanations in German and English, and actionable DNS fix suggestions. Includes the domain checked and timestamp.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "domain": {
   "type": "string",
   "description": "Domain ohne Schema, z. B. example.com"
  },
  "no_cache": {
   "type": "boolean",
   "default": false,
   "description": "Ergebnis-Cache von 6 Stunden je Domain umgehen"
  },
  "dkim_selectors": {
   "type": "array",
   "items": {
    "type": "string"
   },
   "maxItems": 25,
   "description": "Eigene DKIM-Selektoren. Werden zusätzlich zu 25 gängigen Namen probiert, da Selektoren im DNS nicht auflistbar sind."
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "score": 41,
  "checks": {
   "spf": {
    "value": {
     "record": "v=spf1 include:_spf.google.com ~all",
     "dns_lookups": 4,
     "all_mechanism": "~all"
    },
    "detail": {
     "de": "SPF endet auf \"~all\" (softfail).",
     "en": "SPF ends in \"~all\" (softfail)."
    },
    "status": "schwach"
   },
   "dmarc": {
    "value": {
     "record": null
    },
    "detail": {
     "de": "Kein DMARC-Datensatz.",
     "en": "No DMARC record."
    },
    "status": "fehlt"
   }
  },
  "domain": "example.com",
  "findings": [
   {
    "fix": "_dmarc.example.com. 3600 IN TXT \"v=DMARC1; p=none; rua=mailto:dmarc@example.com; adkim=r; aspf=r; pct=100\"",
    "title": {
     "de": "DMARC fehlt",
     "en": "DMARC missing"
    },
    "severity": "kritisch",
    "why_it_matters": {
     "de": "Ohne DMARC entscheidet jeder Empfänger selbst, was mit einer gefälschten Mail geschieht.",
     "en": "Without DMARC every receiver decides for itself what happens to a forged message."
    }
   }
  ],
  "checked_at": "2026-08-06T12:00:00.000Z",
  "spoofing_risk": "hoch"
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/netzhandwerker-email-security-checker-cbdb2759/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from tools.netzhandwerker.de](https://www.zero.xyz/host/tools.netzhandwerker.de/llms.txt)