DomainRef

npx add-mcp 'https://domainref.dev/mcp'

DomainRef

13 checks in one call

Free grade · $0.01 full fixes

Read-only we never change your settings

JSON API, x402 and MCP

One report for the four moments that matter

Mail goes to spam

Find the broken SPF, DKIM or DMARC record, and the exact line that fixes it.

Before a campaign

Gmail and Yahoo bulk-sender rules need SPF, DKIM and DMARC. Check before you send.

Can someone fake you?

See if your domain can be spoofed in phishing, and how to lock it down safely.

Vendor due diligence

New supplier? Check domain age, registrar, Microsoft 365 tenant and mail hygiene.

Not just a lookup. A graded answer with the fix.

	DomainRef	Typical free lookup tool
Output	Pass / warn / fail with the exact record to publish	Raw records, you interpret them
Coverage	13 checks in one call	One record type per lookup
Microsoft 365 aware	✓ tenant + selector1/2 DKIM steps	Varies
For AI agents	✓ JSON API, x402, MCP server	Usually a web form only
Signup or upsell	None. Free grade, $0.01 for the fixes	Often an account or a trial

13 checks, explained in plain words

• SPF

  Who may send as you

  10-lookup limit, ~all vs -all. Guide
• DKIM

  Signed mail

  46 selectors, key size, Microsoft 365 rotation. Guide
• DMARC

  Policy for fakes

  p=, sp=, pct, reports. Guide
• MX

  Can you receive mail

  Present, resolvable, null MX.
• M365

  Microsoft 365 tenant

  Detected from public sign-in discovery.
• TLS

  Website certificate

  Issuer, expiry, hostname, chain.
• MTA-STS

  Encrypted delivery

  Policy, mode, MX coverage. Guide
• TLS-RPT

  Delivery reports

  A valid _smtp._tls rua.
• DNSSEC

  Signed DNS

  Broken DS, weak algorithms. Guide
• CAA

  Who may issue certs

  And whether your CA is allowed.
• BIMI

  Logo in the inbox

  Record and VMC/CMC chain. Guide
• RBL

  Blocklist

  MX and SPF IPs on UCEPROTECT Level 1. Guide
• AGE

  Domain age

  Registrar, created, expiry. New is a fraud signal. Technical detail of every check

Check	What is graded
SPF	One record, at most 10 DNS lookups and 2 void lookups, no ptr. ~all passes when DMARC enforces.
DKIM	46 common selectors probed in parallel, including Microsoft 365 selector1 / selector2, Google, Zoho, Proton, Fastmail, Mandrill, Mailjet, SendGrid, Amazon SES and Mimecast. Flags every key under 2048 bits by selector, with the provider's rotation step.
DMARC	Policy, sp=, pct, reports (rua) and external report authorisation. A hostname falls back to its organisational domain (Public Suffix List).
MX	Present and resolvable. Only an explicit null MX (0 .) counts as no mail.
MTA-STS	The _mta-sts TXT record and the HTTPS policy on mta-sts.<domain>: mode, mx coverage, max_age. A policy senders cannot apply (unreadable, invalid, duplicate TXT or mode: none) is info like no MTA-STS; mx lines that miss an MX fail in enforce mode.
TLS-RPT	A _smtp._tls record with a valid rua.
DNSSEC	Validated by both Cloudflare and Google (they must agree): broken signatures (SERVFAIL that answers with checking off) fail, with the resolver's own error text. Also flags a signed zone with no DS at the registrar, RSA/SHA-1 algorithms 5 and 7 and SHA-1 DS digests (RFC 8624).
CAA	Which CAs may issue, and whether the current certificate's CA is allowed.
Website certificate	The HTTPS certificate on port 443: issuer, days to expiry, hostname match, chain. A small part of the score.
Registration	Registrar (name and IANA ID only), age, expiry and hold flags from the registry's RDAP. A domain under six months old is reported as info here, since only time changes it; the age endpoint grades it. If the registry does not answer, the summary says it was not checked.
Microsoft 365	Tenant detection from Microsoft's public sign-in discovery endpoints. Info only.
BIMI	default._bimi record and its mark certificate: VMC or CMC, issuer, expiry, domain match, and whether the chain leads to a DigiCert, GlobalSign or SSL.com Mark Verifying Authority root (otherwise it is reported as a claim). Also whether DMARC enforces. Info only, never scored.
Blocklist	MX and SPF sending IPs (IPv4, up to 10) on UCEPROTECT Level 1, looked up only while the list's own test entry answers correctly. Level 1 lists single IPs seen hitting UCEPROTECT spamtraps or other abuse, automatically or manually; entries expire 7 days after the last incident. Info or warn, never scored. Copyright © 2001-2021 UCEPROTECT-Network http://www.uceprotect.net, used under the UCEPROTECT licence.

From a browser, a terminal or an AI agent

Same report everywhere. Pick what fits.

API key with card credit

Buy credit once at afriref.dev, then one command per domain. A failed call is refunded to the key.

# your key, your domain
curl -H "X-API-Key: $KEY" \
 "https://domainref.dev/v1/domain/check?domain=yours.com"

Buy credit →

AI agents · x402 / MPP

Pay per call, no key

Call it, read the 402, pay $0.01 USDC on Base, retry. x402 settles only on success.

$ curl -si "https://domainref.dev/v1/domain/check?domain=example.com"
HTTP/2 402
payment-required: eyJ4NDAyVmVyc2lvbiI6Mi…
# any x402 client pays and retries

x402 discovery →

Claude, Cursor & MCP clients

MCP server

Two tools: domain_check and domain_age. Pass api_key; per-call x402 and MPP payment is HTTP only.

{ "mcpServers": { "domainref": {
  "url": "https://domainref.dev/mcp"
} } }

llms.txt · openapi.json

See the JSON an agent gets back (real output for example.com, trimmed to three checks)

{
  "domain": "example.com",
  "score": 100,
  "letter": "A",
  "summary": "example.com scores 100/100 (A): 6 pass, 0 warn, 0 fail, 7 info. Nothing to fix.",
  "checks": [
    { "check": "dmarc", "label": "DMARC", "grade": "pass",
      "finding": "DMARC enforces p=reject on 100% of mail.", "fix": null },
    { "check": "mta_sts", "label": "MTA-STS", "grade": "info",
      "finding": "Not applicable: the domain publishes a null MX, so it takes no mail.", "fix": null },
    { "check": "registration", "label": "Registration (registrar and age)", "grade": "pass",
      "finding": "Registered 1995-08-14 via RESERVED-Internet Assigned Numbers Authority (IANA 376), 11390 days old, expires 2027-08-13.", "fix": null }
  ]
}

Only need the age and registrar? GET /v1/domain/age?domain= is $0.005. Not for registries without RDAP, e.g..za/.co.za,.me,.de,.io,.eu: that lookup is refused free (422).

Grade free. Pay a cent for the fixes.

Full report

$0.01 / domain

• Everything in the free grade
• The exact record or step to fix each finding
• Microsoft 365 tenant + DKIM steps, JSON for agents

Domain age

$0.005 / domain

• Registrar, created, expiry
• Graded for new domains
• RDAP registries only Details

Never charged: bad input, domains that don't exist, private-only domains, broken DNSSEC (you get the diagnosis free), rate limits, DNS or registry outages, and every HEAD request. On every payment rail.

Only what a mail server would see

• Non-intrusive. Public DNS, the registry's RDAP, Microsoft's public discovery and one TLS handshake on port 443 (plus the MTA-STS policy and BIMI certificate when published). No port scans.
• Read-only. We never change anyone's settings. You apply the fix yourself, or hand it to your IT person.
• No stored domains. The DomainRef app does not store queried domains; our firewall log keeps request URLs (with the domain) for about 6 months. A free grade is held in memory for up to 10 minutes, then dropped. The lookup providers see the domain but never who asked. Our CDN necessarily sees your IP and the request. No cookies, trackers or JavaScript on this site.
• Standards-based. RFC 7208 SPF, 6376 DKIM, 7489 DMARC, 8461 MTA-STS, 8624 DNSSEC.
• A real company. 3L Group Consulting (Pty) Ltd, Cape Town. See privacy and terms.

FAQ

What's free and what's paid?

The grade is free: letter, score and pass/warn/fail for every check. The $0.01 full report adds what each check found and the exact fix, Microsoft 365 tenant details and the JSON API.

Why pay $0.01 when free checkers exist?

Free tools mostly show raw records. DomainRef grades all 13 together and writes the exact fix, Microsoft 365 steps included. There's no account, trial or sales call.

Do you change my DNS?

No. DomainRef only reads public records and never logs in to or changes anything. The full report gives the exact copy-paste fix: the DNS record name and value, the corrected SPF line, the Microsoft 365 DKIM CNAMEs or PowerShell commands. You or your IT person apply it at your DNS host.

Do I need a crypto wallet?

No. Buy card credit for an API key at afriref.dev. Wallets and agents can pay per call with x402 or MPP instead.

Do you keep the domains I grade?

The DomainRef app never writes them to disk or its logs. A free grade is held in memory for up to 10 minutes, so a repeat costs no lookups, then dropped. The form sends the domain by POST, so it is not in the URL; a shared /grade?domain= link does carry it, and our firewall log keeps those URLs for about 6 months. The free limit uses a counter keyed by a one-way hash of your IP address, held in memory and deleted within 24 hours.

What if the check fails?

Refusals are free, before any charge. If a paid call still fails, email us the receipt and we refund it.

Does it work for.co.za?

Yes, for every email check. Domain age needs the registry's RDAP, which.za does not offer yet, so the registration line shows as info in the full check and the age-only lookup is refused free.

Grade your domain free. Fix it for a cent.

See your letter grade and which checks fail. Unlock the exact fixes for $0.01.