Mail Security Tools

npx add-mcp 'https://api.mailsecuritytools.com/mcp'

Mail Security Tools API

Free DMARC, SPF, DKIM and MX checks for any domain, from mailsecuritytools.com. Paid (x402 USDC on Base): a $0.01 graded email security score, a $0.01 email address check, a $0.50 bulk score of up to 100 domains, a $0.30 prepaid 30-day watch of up to 25 domains (webhook POST when SPF, DKIM, DMARC or MX changes or breaks), and a $1 email security fix plan with the exact DNS records to publish. MCP server at /mcp. Daily monitoring: InboxGuards (inboxguards.com).

Payments: x402 v2, scheme "exact", USDC on Base mainnet (eip155:8453), asset 0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913, payTo 0x2dAF658B01e257206375798a15832E9f547D65dD. No accounts or API keys. Flow: call the paid URL -> HTTP 402 with a base64 JSON PAYMENT-REQUIRED header -> sign an EIP-3009 USDC authorization for one of accepts -> retry with PAYMENT-SIGNATURE -> 200 + PAYMENT-RESPONSE (settlement receipt). Invalid input returns 400 and is never charged; upstream failures return 5xx and are not settled. Client libraries: @x402/fetch (wrapFetchWithPayment), @x402/axios, or any x402 v2 client.

Paid endpoints

• GET /v1/score $0.01: Graded email security score (0-100, A-F) for a domain. Scores SPF (30), DMARC (40), DKIM (25) and MX (5) from live DNS, with findings and the top 3 fixes. Bad input 400, unknown domain 404, never charged. Query: domain. Example: https://api.mailsecuritytools.com/v1/score?domain=example.com
• GET /v1/email-check $0.01: Email address check: syntax, MX, disposable and role account (no SMTP probe). Checks one address without sending mail. Verdict ok / risky / undeliverable. Bad syntax 400, never charged. Query: email. Example: https://api.mailsecuritytools.com/v1/email-check?email=jane%40example.com
• GET /v1/fix-plan $1: Email security fix plan: the exact SPF, DKIM and DMARC records to publish, with steps for your DNS host. Reads live MX, NS, SPF, DKIM and DMARC, detects the mailbox provider and DNS host, and returns the records to publish in order with a staged DMARC rollout. Non-sending domains get a lock-down set. Bad input 400, unknown domain 404, never charged. Query: domain. Example: https://api.mailsecuritytools.com/v1/fix-plan?domain=example.com
• GET /v1/bulk-score $0.50: Bulk email security score: up to 100 domains in one call. Scores up to 100 domains (comma/space separated) for SPF, DMARC, DKIM and MX from live DNS: per-domain score, grade and issues plus a summary (grade counts, missing DMARC/SPF, worst 10). Built for MSPs and agents checking a whole client or vendor list. Bad input 400 and widespread DNS failure 502, never charged. Query: domains. Example: https://api.mailsecuritytools.com/v1/bulk-score?domains=example.com%2Cexample.org
• POST /v1/watch $0.30: Prepaid email setup watch: up to 25 domains for 30 days, webhook on change. Pay once, then each domain's SPF, DMARC, DKIM (common selectors), MX and score are re-checked about once a day for 30 days. When something changes or breaks you get an HMAC-signed JSON POST at your https webhook_url (event watch.changed, kind changed|broke, before/after). A watch.created POST is sent right away. Webhook only, no email. Free status at GET /v1/watch/{watch_id}. Bad input 400, never charged. Body: JSON (see openapi.json).

Free endpoints

• GET https://api.mailsecuritytools.com/v1/check?domain=: free: MX, SPF (lookups, all qualifier), DMARC (policy, rua) and DKIM (common selectors) in one call
• GET https://api.mailsecuritytools.com/v1/dmarc?domain=: free: DMARC record and issues
• GET https://api.mailsecuritytools.com/v1/spf?domain=: free: SPF record, DNS lookup count and issues
• GET https://api.mailsecuritytools.com/v1/mx?domain=: free: MX records and detected mailbox provider
• GET https://api.mailsecuritytools.com/v1/dkim?domain=&selector=: free: DKIM key for a selector (or common selectors if none given), with key size
• GET https://api.mailsecuritytools.com/v1/watch/{watch_id}: free: status of a paid watch (items, expiry, last check, last webhook delivery, current state)
• POST https://api.mailsecuritytools.com/mcp: MCP server (streamable HTTP, stateless): free check_domain_email_security and pricing; paid email_security_score, check_email_address, email_fix_plan, bulk_email_security_score via x402 in _meta; free watch_status

Discovery

• OpenAPI: https://api.mailsecuritytools.com/openapi.json
• x402 manifest: https://api.mailsecuritytools.com/.well-known/x402
• API catalog (RFC 9727): https://api.mailsecuritytools.com/.well-known/api-catalog
• Sitemap: https://api.mailsecuritytools.com/sitemap.xml

Who runs this

Mail Security Tools (mailsecuritytools.com), an email security tool directory by Orion CMD LLC. For daily SPF/DKIM/DMARC monitoring and alerts see InboxGuards: https://inboxguards.com

Limits

Free endpoints: 30 requests per minute per IP (429 after). Lookups use Cloudflare DNS-over-HTTPS; checks are not stored, except the domains and webhook URL of a paid watch (kept until 30 days after it expires).

Bulk and watch

• GET /v1/bulk-score?domains=a.com,b.com ($0.50): up to 100 domains per call, per-domain score/grade/issues plus a summary.
• POST /v1/watch ($0.30) with JSON {"items": ["a.com"], "webhook_url": "https://..."}: up to 25 domains watched for 30 days. Re-checked about once a day; on any SPF/DMARC/DKIM/MX/grade change you get a signed POST (event watch.changed, kind changed or broke). Header x-watch-signature: t=,v1=HMAC-SHA256(webhook_secret, ${t}.${body}). Webhook only, no email.
• GET /v1/watch/{watch_id} (free): status, expiry, last check, last delivery.