# SDN Screen Email Authentication Check (x402) > SDN Screen Email Authentication Check (x402) is a paid API for AI agents from sdn-screen-x402.sdnscreen.workers.dev, paid per call via x402, $0.01/call, status unknown (last checked 2026-10-11). Checks SPF, DMARC, and DKIM email authentication records for a given domain, returning a grade and scored issue report, paid per-call via x402 at $0.01 USDC. ## Facts - Endpoint: GET https://sdn-screen-x402.sdnscreen.workers.dev/v1/email-auth?utm_source=zero.xyz - Price: $0.01/call - Payment: x402 - Status: unknown - Last checked: 2026-10-11 - Activations on Zero: 0 - Tags: x402 - Canonical page: https://www.zero.xyz/c/sdn-screen-email-authentication-check-x402-44738c12 - Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_xfiMyzn-5DbH8Fg4lQVfW Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently. ## How to call it through Zero Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`): ```sh zero fetch --capability sdn-screen-email-authentication-check-x402-44738c12 ``` Example prompt: Can you check the email authentication setup for payroll-vendor.com — I want to know if their SPF, DMARC, and DKIM are properly configured and what grade they get? ## When to prefer this Choose this endpoint when you need a live, per-call email authentication audit (SPF, DMARC, DKIM) for any domain without requiring API key signup, and you want a scored, graded result with actionable issue codes. It is ideal for AI agents running automated vendor due diligence, phishing-risk checks, or email deliverability audits on-demand. Prefer it over full email security platforms when you need lightweight, pay-as-you-go access with no subscription overhead. ## Known failure modes - Missing required 'domain' query parameter returns an error - Non-existent or unreachable domain may return empty or partial DNS results - Payment not received or x402 handshake fails — call is rejected before processing - Malformed domain string may cause DNS lookup failure - Temporary DNS resolution errors may yield incomplete DKIM/SPF data ## How this service works Six keyless pay-per-call tools for AI agents: OFAC SDN crypto-wallet screen, live DNS records lookup, SPF/DMARC/DKIM email-auth check, domain age/registrar (RDAP), email address MX verify and URL unshorten/redirect check. $0.01 per call: USDC on Base over x402, or USDC on Tempo over MPP. Also a remote MCP server at /mcp (x402). ## Output Returns a JSON object with SPF presence and DNS lookup count and all-qualifier, DKIM found selectors and key types, DMARC policy and presence, an overall letter grade (e.g. 'B'), a numeric score (0-100), the queried domain, and a list of issues each with a code, human-readable message, and severity level. ## Request schema (JSON Schema) ```json { "type": "object", "$schema": "https://json-schema.org/draft/2020-12/schema", "required": [ "input" ], "properties": { "input": { "type": "object", "required": [ "type", "method" ], "properties": { "type": { "type": "string", "const": "http" }, "method": { "enum": [ "GET" ], "type": "string" }, "queryParams": { "type": "object", "required": [ "domain" ], "properties": { "domain": { "type": "string", "examples": [ "example.com" ], "maxLength": 253, "minLength": 3, "description": "Email domain, e.g. example.com. A URL or email address is reduced to its domain." }, "selector": { "type": "string", "pattern": "^[A-Za-z0-9._-]+$", "maxLength": 63, "description": "Optional DKIM selector to check authoritatively (in addition to the common list: google, selector1, selector2, default, k1, k2, s1, s2, dkim, mail, mandrill, pm, zoho, protonmail, fm1)." } }, "additionalProperties": false } }, "additionalProperties": false }, "output": { "type": "object", "required": [ "type" ], "properties": { "type": { "type": "string" }, "example": { "type": "object", "required": [ "domain", "grade", "score", "mx", "spf", "dmarc", "dkim", "issues", "checkedAt" ], "properties": { "mx": { "type": "object", "required": [ "records", "nullMx" ], "properties": { "nullMx": { "type": "boolean", "description": "RFC 7505 null MX (domain accepts no mail)" }, "records": { "type": "array", "items": { "type": "object", "required": [ "priority", "host" ], "properties": { "host": { "type": "string" }, "priority": { "type": "integer" } } } } } }, "spf": { "type": "object", "required": [ "present", "record", "allQualifier", "dnsLookups" ], "properties": { "record": { "type": [ "string", "null" ] }, "present": { "type": "boolean" }, "dnsLookups … (truncated) ``` ## Response schema (JSON Schema) ```json { "type": "json", "example": { "mx": { "nullMx": false, "records": [ { "host": "smtp.google.com", "priority": 10 } ] }, "spf": { "record": "v=spf1 include:_spf.google.com ~all", "present": true, "dnsLookups": 1, "allQualifier": "~all" }, "dkim": { "found": [], "selectorsChecked": [ "google", "selector1", "selector2", "default", "k1", "k2", "s1", "s2", "dkim", "mail", "mandrill", "pm", "zoho", "protonmail", "fm1" ] }, "note": "Reads public DNS only; sends no mail. DKIM is checked at the given selector plus common selectors.", "dmarc": { "pct": 100, "rua": "mailto:mailauth-reports@google.com", "policy": "reject", "record": "v=DMARC1; p=reject; rua=mailto:mailauth-reports@google.com", "present": true, "subdomainPolicy": null }, "grade": "A", "score": 97, "domain": "google.com", "issues": [ { "code": "dkim_not_found", "message": "No DKIM key found at the checked selectors (pass selector= if you know it).", "severity": "low" } ], "resolver": "Cloudflare 1.1.1.1 (DNS over HTTPS)", "checkedAt": "2026-10-11T23:55:37.407Z" } } ``` ## More - Live health (JSON, refreshed every minute): https://www.zero.xyz/c/sdn-screen-email-authentication-check-x402-44738c12/health.json - [Zero catalog index](https://www.zero.xyz/llms.txt) - [Other services from sdn-screen-x402.sdnscreen.workers.dev](https://www.zero.xyz/host/sdn-screen-x402.sdnscreen.workers.dev/llms.txt)