# spoofability-check-bulk

> spoofability-check-bulk is a paid API for AI agents from intel.rallylive.ca, paid per call via x402, $0.1/call, status unknown (last checked 2026-09-14).

Checks up to 20 domains at once to determine whether each can be spoofed in forged emails by evaluating SPF and DMARC configurations together.

## Facts

- Endpoint: GET https://intel.rallylive.ca/bulk/email/spoofable
- Price: $0.1/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-14
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/spoofability-check-bulk-4ad0e93c
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_Io3G8sGYcslFfVnhD8GRt

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability spoofability-check-bulk-4ad0e93c
```

Example prompt: Can you check whether any of these domains can be spoofed in email attacks — example.com, acme.org, widgets.io, and 5 others I'll paste — and tell me which ones are vulnerable along with any errors?

## When to prefer this

Choose this endpoint when you have a list of 2–20 domains and want to check email spoofability for all of them in a single API call rather than making repeated single-domain requests. It is ideal for batch enrichment workflows, security audits, or onboarding pipelines where concurrent processing and ordered results matter. For a single domain, prefer the single /email/spoofable endpoint to avoid unnecessary batch overhead.

## Known failure modes

- Input exceeds 20 domains — batch size limit exceeded
- Malformed or non-existent domain names causing per-item errors with populated error field
- DNS resolution failures for individual domains recorded as per-item errors without failing the whole batch
- Missing or empty input list causing request rejection
- Payment not completed (x402 protocol) resulting in 402 response before processing

## How this service works

Bulk spoofability check: up to 20 domains in one call, processed concurrently, results returned in input order with a per-item error field and a count of failures. Same answer per item as the single /email/spoofable endpoint (Can this domain be spoofed? Checks whether SPF and DMARC together actually block forged mail). Batch enrichment for agents that hold a list. $0.01 per batch.

## Output

An ordered array of results matching the input domain list, where each item contains whether the domain is spoofable, the underlying SPF and DMARC evaluation details (same as the single /email/spoofable endpoint), a per-item error field if the check failed for that domain, and a summary count of how many items failed across the batch.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "properties": {}
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/spoofability-check-bulk-4ad0e93c/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from intel.rallylive.ca](https://www.zero.xyz/host/intel.rallylive.ca/llms.txt)