{"uid":"cap_J5Aoay19ZFj1hGDLqapKg","slug":"domain-trust-check-dns-email-auth-tls-headers-aa80d79c","name":"Domain Trust Check (DNS, Email Auth, TLS, Headers)","description":"Live technical checks of a domain, measured by us at request time: A/AAAA, NS, MX records, SPF and DMARC policies, DNSSEC presence (DS), CAA, TLS certificate issuer, validity dates and hostname match on port 443, and HTTPS security headers (HSTS, CSP, X-Frame-Options). Returns a simple risk flag list. Use when an agent must sanity-check a company's or vendor's domain before trusting an email, link or supplier: does it resolve, receive mail, publish SPF/DMARC, and serve a valid TLS certificate.","url":"https://domain-check-production-6228.up.railway.app/v1/domain/check?utm_source=zero.xyz","method":"GET","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method"],"properties":{"type":{"type":"string","const":"http"},"method":{"enum":["GET"],"type":"string"},"queryParams":{"type":"object","required":["domain"],"properties":{"domain":{"type":"string","description":"Domain name, e.g. example.com (no scheme or path)"}}}},"additionalProperties":false},"output":{"type":"object","required":["type"],"properties":{"type":{"type":"string"},"example":{"type":"object"}}}}},"responseSchema":{"type":"json","example":{"mx":[{"exchange":"mx.example.com","priority":10}],"spf":"v=spf1 -all","tls":{"valid":true,"issuer":"DigiCert","valid_to":"2027-01-15","hostname_match":true},"dmarc":{"policy":"reject"},"flags":[],"legal":{"terms":"https://domain-check-production-6228.up.railway.app/terms","privacy":"https://domain-check-production-6228.up.railway.app/privacy"},"domain":"example.com","status":"ok","headers":{"hsts":true},"resolves":true,"use_when":"Use when an agent must sanity-check a company's or vendor's domain before trusting an email, link or supplier: does it resolve, receive mail, publish SPF/DMARC, and serve a valid TLS certificate."}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.003","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.003/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.003","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.003","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_esI_vcmUSf3019Zkk3MfK","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.003","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Performs live technical security checks on a domain including DNS records, SPF/DMARC email authentication, DNSSEC, TLS certificate validity, and HTTPS security headers, returning a risk flag list.","exampleAgentPrompt":"Before I reply to this invoice from payments@acmecorp.io, can you run a full domain trust check on acmecorp.io — DNS resolution, MX records, SPF, DMARC, TLS certificate validity, and HSTS — and tell me if anything looks off?","exampleUseCases":[{"title":"Vendor onboarding domain vetting","prompt":"I'm about to onboard a new software supplier and they gave me their domain techsupplyco.com — can you check if it resolves, has valid MX and SPF records, a DMARC reject policy, and a legit TLS certificate before I send them any sensitive info?"},{"title":"Phishing email sender verification","prompt":"I got an email from billing@globalfinancepartners.net and I'm not sure it's legit — can you do a full domain check on globalfinancepartners.net to see if the DNS resolves, SPF and DMARC are set up correctly, and the TLS cert is valid?"},{"title":"Security audit of partner domain","prompt":"Run a domain security audit on stripe.com for me — I want to see their DNS records, whether DNSSEC is enabled, what their DMARC policy is, who issued their TLS cert, and whether they have HSTS and CSP headers set."}],"resultDescription":"Returns a JSON object with: DNS resolution status (resolves boolean), MX records with priority, SPF record text, DMARC policy, TLS certificate details (issuer, valid_to date, hostname match, validity boolean), HTTPS security headers (HSTS, CSP, X-Frame-Options), DNSSEC/CAA presence, overall status field, and a flags array listing detected risk issues. An empty flags array indicates no issues found.","failureModes":["Domain does not resolve — resolves:false with empty DNS records","Invalid domain format input — likely 4xx error or error status in response","TLS check fails if port 443 is not open or certificate is expired — reflected in tls.valid:false","DMARC or SPF absent — reflected as null/missing fields rather than a hard error","Network timeout reaching the target domain — may return partial results or error status","Railway hosting outage causing the service itself to be unavailable"],"whenToPreferThis":"Use this endpoint when an agent needs a live, real-time technical trust assessment of a domain before acting on an email, link, or supplier relationship — especially when you need all of DNS, email auth (SPF/DMARC), TLS certificate validity, and HTTPS headers checked in a single call. Prefer this over manual DNS lookups or separate TLS checkers when you want a consolidated risk flag list with no setup required. Best for pre-flight checks in automated supplier onboarding, phishing triage, or security compliance workflows.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-17T12:30:08.460Z","isFirstParty":false,"canonicalSlug":"domain-trust-check-dns-email-auth-tls-headers-aa80d79c"}