Email Security Audit
Full inbound/outbound email authentication audit for a domain: MX reachability, SPF policy grade, DKIM selector discovery across common selectors, DMARC policy grade, and a composite score with concrete fixes. One call instead of five — the diligence an agent runs before trusting or emailing a domain.
🔌 Server-side tool
This tool runs on the server (it fetches third-party URLs directly and cannot run in your browser). Use the paid JSON API below — the worked examples show real server-side results and refresh automatically.
Worked examples
GET /api/v1/security/email-security-audit?domain=gmail.com
Result: Grade D — 41/100 · SPF soft · DKIM ✗ · DMARC none · MX ✓
A strict sender
GET /api/v1/security/email-security-audit?domain=paypal.com
Result: Grade A — 90/100 · SPF soft · DKIM ✓ · DMARC reject · MX ✓
Unconfigured domain
GET /api/v1/security/email-security-audit?domain=example.org
Result: Grade B — 75/100 · SPF strict · DKIM ✓ · DMARC reject · MX ✗
Machine API (x402)
$0.02 / callThis tool is also a JSON API for AI agents. Requests without payment receive 402 Payment Required plus instructions; agents pay USDC on Base via the x402 protocol — no accounts, no API keys.
GET /api/v1/security/email-security-audit?domain=gmail.com HTTP/1.1
Host: agentstoolshub.com
→ 402 (payment required, instructions in headers)
→ 200 (after X-PAYMENT header; JSON body below)
{
"tool": "security/email-security-audit",
"input": {"domain":"gmail.com"},
"result": { "value": 41, "answer": "Grade D — 41/100 · SPF soft · DKIM ✗ · DMARC none · MX ✓" }
}Agent docs: /llms.txt · OpenAPI spec · integration guide
About this tool
The complete email-authentication report card in one call: MX reachability, SPF strictness, DKIM key discovery (probing the selectors real deployments use), and DMARC policy — each pillar scored out of 25 with concrete fixes for what's missing. Use it before trusting a domain's mail or emailing on a partner's behalf.
Frequently asked questions
Why might DKIM show ✗ for a working sender?
DKIM selectors are arbitrary private labels. The audit probes the common ones (google, selector1/2, default, k1, s1…); enterprise deployments can use any name, so a miss means 'not publicly discoverable', not necessarily 'not signed'.
How is the score composed?
Four pillars, 25 points each: MX (receives mail), SPF (sender authorization, more for -all than ~all), DKIM (published public key) and DMARC (policy strictness — p=reject full marks, p=none minimal).