# Tanod Web – Domain Inspect (DNS, Email, TLS)

> Tanod Web – Domain Inspect (DNS, Email, TLS) is a paid API for AI agents from web.tanod.dev, paid per call via x402, $0.004/call, status unknown (last checked 2026-10-13).

Inspects a domain's email security posture (SPF, DMARC, DKIM, MTA-STS) and optionally DNS and TLS configurations, returning a structured health report.

## Facts

- Endpoint: POST https://web.tanod.dev/v1/domain/inspect?utm_source=zero.xyz
- Price: $0.004/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-13
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/tanod-web-domain-inspect-dns-email-tls-e221ac40
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_wzKsDmoTAp0i3QNPlCfhb

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability tanod-web-domain-inspect-dns-email-tls-e221ac40 -d '<json body>'
```

Example prompt: Can you inspect github.com's email security — check its SPF, DMARC, and DKIM setup and let me know if there are any issues?

## When to prefer this

Choose this endpoint when you need a structured, scored breakdown of a domain's email security (SPF, DMARC, DKIM, MTA-STS) rather than raw DNS lookups. It's ideal for deliverability audits, security posture assessments, and onboarding checks for new domains. Prefer it over generic DNS resolvers when you need interpreted results and actionable issue lists rather than raw record values.

## Known failure modes

- Invalid domain name format returns a validation error
- Domain does not exist in DNS — partial or empty results returned
- Network timeout reaching external DNS or TLS endpoints
- Requesting more than 3 check types or an invalid check type enum causes a 400 error
- DKIM selector discovery may miss non-standard selectors

## How this service works

Web tools: search, page to Markdown or screenshot, company profile and jobs, sitemaps, RDAP, IP.

## Output

A structured JSON report containing results for each requested check section (email, dns, tls). The email section includes SPF details (present, all_policy, dns_lookup_count, issues), DMARC configuration (policy, subdomain_policy, pct, rua, issues), DKIM selectors found, MTA-STS status, whether the domain accepts mail, and an overall email security score out of 8. Additional notes and the list of checks performed are also returned.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "checks": {
   "type": "array",
   "items": {
    "enum": [
     "dns",
     "email",
     "tls"
    ],
    "type": "string"
   },
   "maxItems": 3,
   "minItems": 1,
   "description": "Which sections to run (default all three)."
  },
  "domain": {
   "type": "string",
   "maxLength": 253,
   "description": "Domain name (no scheme, no IP literal)."
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "email": {
   "spf": {
    "issues": [],
    "present": true,
    "all_policy": "softfail",
    "dns_lookup_terms": 8
   },
   "dmarc": {
    "pct": 100,
    "rua": "mailto:dmarc@github.com",
    "issues": [],
    "policy": "quarantine",
    "present": true,
    "subdomain_policy": "reject"
   },
   "mta_sts": false,
   "accepts_mail": true,
   "score_out_of_8": 7,
   "dkim_selectors_found": [
    "google",
    "selector1"
   ]
  },
  "notes": [],
  "checks": [
   "email"
  ],
  "domain": "github.com"
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/tanod-web-domain-inspect-dns-email-tls-e221ac40/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from web.tanod.dev](https://www.zero.xyz/host/web.tanod.dev/llms.txt)