Email Authentication Check

Check a domain's email authentication from live DNS: SPF, DMARC policy, mail servers and DKIM selectors. The check to run before sending outreach.

Pay by wallet (x402) email-auth-check

Example

Input

{
  "domain": "google.com"
}

Answer

{
  "domain": "google.com",
  "has_mx": true,
  "mx_hosts": [
    "smtp.google.com"
  ],
  "dkim_note": "DKIM probed via common selectors only — a miss does not prove the domain has no DKIM; pass dkim_selector for an exact check",
  "dmarc_pct": null,
  "dkim_found": [
    {
      "selector": "google",
      "record_present": true
    }
  ],
  "spf_record": "v=spf1 include:_spf.google.com ~all",
  "spf_status": "present",
  "auth_summary": "enforced",
  "dmarc_policy": "reject",
  "dmarc_record": "v=DMARC1; p=reject; rua=mailto:...",
  "dmarc_status": "present",
  "dmarc_present": true,
  "dmarc_inherited_from": null,
  "dkim_checked_selectors": [
    "default",
    "google",
    "selector1",
    "selector2",
    "k1",
    "s1",
    "dkim"
  ],
  "dmarc_effective_policy": "reject",
  "dmarc_subdomain_policy": null
}

Inputs

Field	Type	Required	What it is
`task`	string	No	Free-text alias — domain or email address
`email`	string	No	Alias — a full email address; its domain is checked
`domain`	string	No	Domain to check (e.g. example.com)
`dkim_selector`	string	No	Optional exact DKIM selector to probe (otherwise common selectors are tried)

Output fields

How reliably each field appears in a successful answer.

Field	Type	Appears
`domain`	string	Always (present in every successful answer)
`has_mx`	boolean	Always (present in every successful answer)
`mx_hosts`	array	Always (present in every successful answer)
`dkim_note`	string or null	Usually (present for most inputs)
`dkim_found`	array	Always (present in every successful answer)
`spf_record`	string or null	Usually (present for most inputs)
`spf_status`	one of present, missing, invalid_multiple	Always (present in every successful answer)
`auth_summary`	one of enforced, partially_enforced, configured_monitor_only, incomplete	Always (present in every successful answer)
`dmarc_policy`	string or null	Usually (present for most inputs)
`dmarc_record`	string or null	Usually (present for most inputs)
`dmarc_status`	one of present, missing, invalid_multiple	Always (present in every successful answer)
`dmarc_present`	boolean	Always (present in every successful answer)
`dmarc_inherited_from`	string or null	Sometimes (present only for some inputs)
`dkim_checked_selectors`	array	Always (present in every successful answer)
`dmarc_effective_policy`	string or null	Usually (present for most inputs)
`dmarc_subdomain_policy`	—	Sometimes (present only for some inputs)
`dmarc_pct`	—	Sometimes (present only for some inputs)

How to call it

The same tool through each route. MCP clients reach it through Strale’s server at https://api.strale.io/mcp; the call below is what the agent sends.

# Needs an API key. max_price_cents caps what this call may cost.
curl -X POST https://api.strale.io/v1/do \
  -H "Authorization: Bearer $STRALE_API_KEY" \
  -H 'Content-Type: application/json' \
  -d '{
    "capability_slug": "email-auth-check",
    "inputs": {
      "domain": "google.com"
    },
    "max_price_cents": 3
  }'

{
  "tool": "strale_execute",
  "arguments": {
    "slug": "email-auth-check",
    "inputs": {
      "domain": "google.com"
    },
    "max_price_cents": 3
  }
}

import { Strale } from "straleio";

const strale = new Strale({ apiKey: process.env.STRALE_API_KEY! });
const result = await strale.do({
  capability_slug: "email-auth-check",
  inputs: {
    "domain": "google.com"
  },
  max_price_cents: 3,
});

import os
from straleio import Strale, DoRequest

strale = Strale(api_key=os.environ["STRALE_API_KEY"])
result = strale.do(DoRequest(
    capability_slug="email-auth-check",
    inputs={
        "domain": "google.com",
    },
    max_price_cents=3,
))

# No account. The first request answers 402 with the price in USDC;
# an x402 client pays it from your wallet and repeats the request.
curl -i -X POST https://api.strale.io/x402/v2/email-auth-check \
  -H 'Content-Type: application/json' \
  -d '{
    "domain": "google.com"
  }'

Limitations

Custom DKIM selectors can be missed
Without a dkim_selector input, only common selectors (default, google, selector1/2, k1, s1, dkim) are probed. DKIM published under a custom selector will not be found; the output says "not found via common selectors", never "domain has no DKIM".
What to do instead: Pass dkim_selector for an exact check (find it in a received message's DKIM-Signature s= tag)
SPF is presence/shape-checked, not fully evaluated
The check verifies a single valid-looking v=spf1 record exists (and flags the RFC 7208 multiple-record failure) but does not recursively evaluate includes or compute the effective pass set.