Email authentication posture (SPF, DMARC, MTA-STS) API

Email authentication posture of a domain from DNS (Cloudflare DNS over HTTPS): MX records and null MX, SPF parsed into mechanisms with its all qualifier and a recursive DNS-lookup count against the RFC 7208 limit of 10, DMARC policy (p, sp, pct, alignment, report addresses' domains), MTA-STS and TLS-RPT records, and BIMI. DKIM is not assessed because selectors cannot be enumerated. Returns an A-F grade and 0-100 score with weighted reasons.

$0.003 per call USDC over x402 v2 on Base, Polygon, Arbitrum, Avalanche or Sei. No signup, no API key. Requests that fail or match nothing are not charged.

Endpoint

GET https://domain.kit-rx.com/v1/domain/email-auth

Parameters

Name	Type	Required	Description
`domain`	string	yes	Bare domain, hostname, email address or URL. Scheme, path, port and credentials are stripped and IDNs are converted to punycode. IP addresses and private names are rejected. e.g. `github.com`

Example request

https://domain.kit-rx.com/v1/domain/email-auth?domain=github.com

Without payment the server answers 402 Payment Required with the price (3000 atomic USDC) in the PAYMENT-REQUIRED header. Any x402 v2 client pays and retries automatically. A request with no parameters runs this example.

curl -i "https://domain.kit-rx.com/v1/domain/email-auth?domain=github.com"

Pay from an agent

AgentCash: fetch the URL. OpenDexter MCP: x402_fetch. Kit Rx MCP server: https://domain.kit-rx.com/mcp. Code:

import { x402Client } from "@x402/core/client";
import { registerExactEvmScheme } from "@x402/evm/exact/client";
import { wrapFetchWithPayment } from "@x402/fetch";
import { privateKeyToAccount } from "viem/accounts";

const client = new x402Client();
registerExactEvmScheme(client, { signer: privateKeyToAccount(process.env.BUYER_KEY) });
const pay = wrapFetchWithPayment(fetch, client);
const res = await pay("https://domain.kit-rx.com/v1/domain/email-auth?domain=github.com");
console.log(await res.json());

Example response

{
  "query": {
    "domain": "github.com"
  },
  "result": {
    "domain": "github.com",
    "input_host": "github.com",
    "registrable_domain": "github.com",
    "grade": "B",
    "score": 88,
    "reasons": [
      {
        "code": "dmarc_quarantine",
        "points": -5,
        "detail": "DMARC policy is quarantine; reject is the strongest setting."
      },
      {
        "code": "no_mta_sts",
        "points": -5,
        "detail": "No MTA-STS record, so inbound SMTP TLS is opportunistic and can be downgraded."
      },
      {
        "code": "no_tls_rpt",
        "points": -2,
        "detail": "No TLS-RPT record, so the owner receives no reports of SMTP TLS failures."
      }
    ],
    "mx": {
      "accepts_mail": true,
      "null_mx": false,
      "implicit_mx": false,
      "records": [
        {
          "priority": 0,
          "host": "github-com.mail.protection.outlook.com"
        }
      ]
    },
    "spf": {
      "present": true,
      "multiple_records": false,
      "record": "v=spf1 ip4:192.30.252.0/22 include:spf.protection.outlook.com … ~all",
      "all": "~all",
      "effective_all": "~all",
      "redirect": null,
      "mechanisms": [
        {
          "qualifier": "+",
          "mechanism": "ip4",
          "value": "192.30.252.0/22"
        },
        {
          "qualifier": "+",
          "mechanism": "include",
          "value": "spf.protection.outlook.com"
        },
        {
          "qualifier": "~",
          "mechanism": "all",
          "value": null
        }
      ],
      "dns_lookups": {
        "counted": 10,
        "top_level": 8,
        "limit": 10,
        "exceeds_limit": false,
        "complete": true,
        "loop": false
      },
      "broken_includes": [],
      "uses_ptr": false,
      "unknown_terms": []
    },
    "dmarc": {
      "present": true,
      "record_domain": "github.com",
      "inherited": false,
      "record": "v=DMARC1; p=quarantine; sp=reject; pct=100; rua=mailto:[redacted]@github.com; ruf=mailto:[redacted]@github.com; fo=1",
      "policy": "quarantine",
      "p": "quarantine",
      "sp": "reject",
      "pct": 100,
      "adkim": null,
      "aspf": null,
      "rua_present": true,
      "rua_domains": [
        "github.com"
      ],
      "ruf_present": true,
      "multiple_records": false
    },
    "mta_sts": {
      "present": false,
      "valid": false,
      "id": null
    },
    "tls_rpt": {
      "present": false,
      "rua_present": false
    },
    "bimi": {
      "present": false,
      "logo_url": null,
      "has_certificate": false
    },
    "dkim": {
      "assessed": false,
      "detail": "DKIM keys are published under sender-chosen selectors …"
    }
  },
  "sources": [
    {
      "name": "Cloudflare DNS over HTTPS (JSON API)",
      "url": "https://developers.cloudflare.com/1.1.1.1/encryption/dns-over-https/make-api-requests/dns-json/"
    }
  ],
  "attribution": [
    "DNS resolved via Cloudflare 1.1.1.1 DNS-over-HTTPS."
  ],
  "generated_at": "2026-11-14T21:47:15.232Z"
}

Kit Rx Domain WHOIS, DNS & Email Security: Domain intelligence for AI agents: WHOIS (RDAP), DNS, SPF/DKIM/DMARC email security, bulk checks and due-diligence scores, paid per call over x402. Machine-readable: OpenAPI, llms.txt, /.well-known/x402, agent skills.