{"uid":"cap_AEDOiaB9g55Gif1FvQtaJ","slug":"2s-domain-email-security-audit-03f48e33","name":"2s Domain Email Security Audit","description":"Grade a domain's email-authentication and DNS-security posture from live DNS in one call: SPF, DMARC (policy + alignment), DKIM (for the supplied or common selectors), MTA-STS, TLS-RPT, DNSSEC, CAA, and BIMI. Pass domain (and optional dkimSelector). Returns an overall letter grade, a summary (spf/dmarcPolicy/dkim/mtaSts/dnssec/caa/bimi + spoofingProtected), and a per-mechanism block with the raw record, parsed tags, and specific issues (e.g. 'DMARC p=none — monitor only', 'SPF ~all soft-fail', 'no MTA-STS'). Sourced from live public DNS via DNS-over-HTTPS — an LLM cannot know a domain's current records. For deliverability/anti-spoofing audits, vendor security review, and phishing-resistance checks. DKIM is selector-based (selectors aren't enumerable), so 'not found' only means none of the checked selectors resolved.","url":"https://2s.io/api/domain/email-security?utm_source=zero.xyz","method":"GET","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method","queryParams"],"properties":{"type":{"const":"http"},"method":{"const":"GET"},"queryParams":{"required":["domain"],"properties":{"domain":{"type":"string","description":"Domain to audit (e.g. example.com)."},"dkimSelector":{"type":"string","description":"Optional known DKIM selector (e.g. \"google\", \"s1\")."}}}}}}},"responseSchema":null,"example":{"request":{"input":{"type":"http","method":"GET","queryParams":{"domain":"example.com"}}},"response":{"data":{"ok":true,"items":[{"caa":{"issues":["no CAA record — any CA may issue certs for this domain"],"record":null,"issuers":[],"present":false},"spf":{"issues":[],"record":"v=spf1 -all","present":true},"bimi":{"issues":[],"record":null,"present":false},"dkim":{"issues":[],"record":"8 selector(s) found","present":true,"selectorsFound":["default","google","selector1","selector2","k1","mail","s1","dkim"],"selectorsChecked":["default","google","selector1","selector2","k1","mail","s1","dkim"]},"note":"Posture from live DNS records. DKIM is selector-based (selectors are not enumerable) — a \"not found\" only means none of the checked selectors resolved. Not a guarantee of deliverability.","dmarc":{"issues":["no rua= aggregate-report address"],"parsed":{"p":"reject","v":"DMARC1","sp":"reject","aspf":"s","adkim":"s"},"record":"v=DMARC1;p=reject;sp=reject;adkim=s;aspf=s","present":true},"grade":"B","dnssec":{"enabled":true},"domain":"example.com","mtaSts":{"issues":["no MTA-STS — SMTP downgrade attacks not prevented"],"record":null,"present":false},"source":{"url":"https://developers.google.com/speed/public-dns/docs/doh","license":"Live DNS queries; public records, no upstream license.","provider":"Live DNS via public DNS-over-HTTPS resolvers"},"tlsRpt":{"issues":[],"record":null,"present":false},"summary":{"caa":false,"spf":true,"bimi":false,"dkim":true,"dnssec":true,"mtaSts":false,"dmarcPolicy":"reject","spoofingProtected":true}}],"total":1,"source":{"url":"https://developers.google.com/speed/public-dns/docs/doh","license":"Live DNS queries; public records, no upstream license.","provider":"Live DNS via public DNS-over-HTTPS resolvers"}},"meta":{"cost":{"usd":0.0018,"tier":0},"caller":"x402","version":null,"endpoint":"domain.email-security","settlement":{"txHash":"0x615f3262e84237a015eaa7b2f5f687b993e21f22bb7567a78f7b3369b92ee22c","network":"eip155:8453","success":true}}}},"exampleRequest":{"domain":"example.com"},"tags":["x402"],"displayCostAmount":"0.0018","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"settled","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.0018/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.0045","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.0045","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_fdLciExOx-jnyw1jQCLAZ","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.0045","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Audits a domain's email security configuration by checking SPF, DKIM, DMARC, BIMI, DNSSEC, MTA-STS, and CAA DNS records and returning a grade and spoofing-protection summary.","exampleAgentPrompt":"Can you run a full email security audit on paypal.com — check its DMARC, SPF, DKIM, DNSSEC, MTA-STS and everything else, and tell me what grade it gets and whether it's protected against spoofing?","exampleUseCases":null,"resultDescription":"Returns a JSON object with an overall letter grade (e.g. 'A'), a summary boolean for each record type (SPF, DKIM, DMARC, BIMI, DNSSEC, MTA-STS, CAA), the raw DMARC record string, parsed DMARC policy fields, a list of detected issues, and a spoofingProtected flag. Sourced from live DNS-over-HTTPS queries.","failureModes":["Domain does not exist or has no DNS records — returns empty items array","Invalid domain format — likely 400 error or empty result","DKIM check inconclusive if no selector is provided or selector is wrong","Payment not received — 402 response, call not executed","Transient DNS resolution failure — may return partial data or error"],"whenToPreferThis":"Use this endpoint when you need a comprehensive, multi-record email security posture check for a domain in a single call — covering SPF, DKIM, DMARC, BIMI, DNSSEC, MTA-STS, and CAA together with an overall grade and spoofing-protection verdict. Prefer it over manual DNS lookups or single-record checkers when you want a holistic audit with structured output and no API key overhead.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-12T18:47:10.914Z","isFirstParty":false,"canonicalSlug":"2s-domain-email-security-audit-03f48e33"}