All tools / Domain Email Auth Check

Domain Email Auth Check

Inspect a public domain’s MX, SPF, supplied DKIM selectors, direct DMARC record and resolver-reported DNSSEC evidence, with a bounded fix list.

Read the API and limits

Who it’s for

Mail operators, API sellers and agents reviewing public email-auth DNS configuration.

Price

0.005 USDC per usable report; no shared trial. No usable DNS response means no charge.

Paid calls use x402 with USDC on Base. Read the quote before authorizing payment; examples below do not pay automatically.

Know the limits

Public DNS observations only, not a secure-domain or inbox-delivery verdict. DKIM is unknown without supplied selectors; no message signature or sender alignment is verified. DMARC checks the exact-domain record and leaves inherited policy/tree-walk results unknown. DNSSEC AD is the resolver’s attestation, not independent validation. No mail, SMTP, DNS changes, recursive SPF expansion or queried-domain retention.

A 30-second integration

Examples use placeholders. Plain requests to paid tools return a payment challenge, not a paid result. Free Lint can perform an unpaid public probe. Inspect the response status and evidence scope before using any result.

curl

curl -i https://api.spendpreflight.com/v1/domain-auth \
  -H 'Content-Type: application/json' \
  -d '{"domain":"example.org","selectors":["selector1"]}'

MCP

Connect to https://api.spendpreflight.com/mcp. Call the existing tool:

{
  "name": "domain_auth",
  "arguments": {
    "domain": "example.org",
    "selectors": [
      "selector1"
    ]
  }
}

SDK / JavaScript

Use standard fetch alongside the SpendPreflight SDK; the example does not invent a dedicated exported method.

// Node.js SDK integration: use your explicitly budgeted fetch.
// Plain fetch below never signs or pays. There is no dedicated
// spendpreflight SDK helper for this operation.
const response = await fetch('https://api.spendpreflight.com/v1/domain-auth', {
  method: 'POST', headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({"domain":"example.org","selectors":["selector1"]})
});
console.log(response.status, await response.text());

Frequently asked questions

Can this prove mail reaches an inbox?

No. Publishing SPF, DKIM or DMARC records does not prove sender authentication, alignment, inbox placement or ownership. This tool never sends mail or connects to an SMTP server.

Why is DKIM unknown?

DKIM selectors come from your mail configuration or signed messages. Supply up to three known selectors; none are guessed. The tool observes the key record, not a message signature.

Does a missing MX or DMARC record mean mail is broken?

No. SMTP can use implicit A/AAAA fallback, which is untested here; DMARC can inherit policy, whose RFC9989 tree walk is outside this bounded review. Verify receiving and sending intent before changing records.

Will the fixes change my DNS?

No. They are review guidance with primary sources, not generated replacement policies. Inventory every authorized sender and verify alignment before enforcing a stronger policy.

Authoritative OpenAPI schemas · What this service stores · Practical guides