# Mail Security Tools API
> Free DMARC, SPF, DKIM and MX checks for any domain, from mailsecuritytools.com. Paid (x402 USDC on Base): a $0.01 graded email security score, a $0.01 email address check, and a $1 email security fix plan with the exact DNS records to publish. MCP server at /mcp. Daily monitoring: InboxGuards (inboxguards.com).

Payments: x402 v2, scheme "exact", USDC on Base mainnet (eip155:8453), asset 0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913, payTo 0x2dAF658B01e257206375798a15832E9f547D65dD. No accounts or API keys.
Flow: call the paid URL -> HTTP 402 with a base64 JSON PAYMENT-REQUIRED header -> sign an EIP-3009 USDC authorization for one of `accepts` -> retry with PAYMENT-SIGNATURE -> 200 + PAYMENT-RESPONSE (settlement receipt). Invalid input returns 400 and is never charged; upstream failures return 5xx and are not settled.
Client libraries: @x402/fetch (wrapFetchWithPayment), @x402/axios, or any x402 v2 client.

## Paid endpoints
- [GET /v1/score](https://api.mailsecuritytools.com/v1/score) $0.01: Graded email security score (0-100, A-F) for a domain. Scores SPF (30), DMARC (40), DKIM (25) and MX (5) from live DNS, with findings and the top 3 fixes. Bad input 400, unknown domain 404, never charged. Query: `domain`. Example: https://api.mailsecuritytools.com/v1/score?domain=example.com
- [GET /v1/email-check](https://api.mailsecuritytools.com/v1/email-check) $0.01: Email address check: syntax, MX, disposable and role account (no SMTP probe). Checks one address without sending mail. Verdict ok / risky / undeliverable. Bad syntax 400, never charged. Query: `email`. Example: https://api.mailsecuritytools.com/v1/email-check?email=jane%40example.com
- [GET /v1/fix-plan](https://api.mailsecuritytools.com/v1/fix-plan) $1: Email security fix plan: the exact SPF, DKIM and DMARC records to publish, with steps for your DNS host. Reads live MX, NS, SPF, DKIM and DMARC, detects the mailbox provider and DNS host, and returns the records to publish in order with a staged DMARC rollout. Non-sending domains get a lock-down set. Bad input 400, unknown domain 404, never charged. Query: `domain`. Example: https://api.mailsecuritytools.com/v1/fix-plan?domain=example.com

## Free endpoints
- GET https://api.mailsecuritytools.com/v1/check?domain=: free: MX, SPF (lookups, all qualifier), DMARC (policy, rua) and DKIM (common selectors) in one call
- GET https://api.mailsecuritytools.com/v1/dmarc?domain=: free: DMARC record and issues
- GET https://api.mailsecuritytools.com/v1/spf?domain=: free: SPF record, DNS lookup count and issues
- GET https://api.mailsecuritytools.com/v1/mx?domain=: free: MX records and detected mailbox provider
- GET https://api.mailsecuritytools.com/v1/dkim?domain=&selector=: free: DKIM key for a selector (or common selectors if none given), with key size
- POST https://api.mailsecuritytools.com/mcp: MCP server (streamable HTTP, stateless): free check_domain_email_security and pricing; paid email_security_score, check_email_address, email_fix_plan via x402 in _meta

## Discovery
- OpenAPI: https://api.mailsecuritytools.com/openapi.json
- x402 manifest: https://api.mailsecuritytools.com/.well-known/x402
- API catalog (RFC 9727): https://api.mailsecuritytools.com/.well-known/api-catalog
- Sitemap: https://api.mailsecuritytools.com/sitemap.xml

## Who runs this
Mail Security Tools (mailsecuritytools.com), an email security tool directory by Orion CMD LLC. For daily SPF/DKIM/DMARC monitoring and alerts see InboxGuards: https://inboxguards.com

## Limits
Free endpoints: 30 requests per minute per IP (429 after). Lookups use Cloudflare DNS-over-HTTPS; nothing is stored.