DomainRef
Domain and email security check for agents and scripts. $0.01 per domain.
Use it when mail lands in spam, before a campaign, for vendor due diligence or to confirm a Microsoft 365 tenant. One call grades SPF, DKIM, DMARC, MX, MTA-STS, TLS-RPT, DNSSEC, CAA, the website certificate and the domain's age. Every check comes back pass, warn, fail or info with the exact record or step that fixes it, plus a 0-100 score.
What it checks
| Check | What is graded |
|---|---|
| SPF | One record, at most 10 DNS lookups and 2 void lookups, no ptr. ~all passes when DMARC enforces. |
| DKIM | 46 common selectors probed in parallel, including Microsoft 365 selector1/selector2, Google, Zoho, Proton, Fastmail, Mandrill, Mailjet, SendGrid, Amazon SES and Mimecast. Flags 1024-bit keys. |
| DMARC | Policy, sp=, pct, reports (rua) and external report authorisation. A hostname falls back to its organisational domain (Public Suffix List). |
| MX | Present and resolvable. Only an explicit null MX (0 .) counts as no mail. |
| MTA-STS | The _mta-sts TXT record and the HTTPS policy on mta-sts.<domain>: mode, mx coverage, max_age. |
| TLS-RPT | A _smtp._tls record with a valid rua. |
| DNSSEC | DS at the parent and a validated answer. |
| CAA | Which CAs may issue, and whether the current certificate's CA is allowed. |
| Website certificate | The HTTPS certificate on port 443: issuer, days to expiry, hostname match, chain. A small part of the score. |
| Registration | Registrar (name and IANA ID only), age, expiry and hold flags from the registry's RDAP. Under 30 days old fails. |
| Microsoft 365 | Tenant detection from Microsoft's public sign-in discovery endpoints. Info only. |
| BIMI | default._bimi record. Info only, never scored. |
Optional features you have not deployed (MTA-STS, TLS-RPT, DNSSEC, CAA, BIMI) show as info with the record to add. They never lower the score.
Try it
Call it without payment and you get the x402 price challenge:
$ curl -si "https://www.domainref.dev/v1/domain/check?domain=example.com" | grep -iE "^HTTP|^payment-required"
HTTP/2 402
payment-required: eyJ4NDAyVmVyc2lvbiI6Mi...Any x402 client reads that 402, pays $0.01 in USDC on Base (eip155:8453) and retries. No key, no signup. A bad domain name, a domain that does not exist, a private-only domain, a DNS outage or a rate limit is refused free, before any charge.
Only need the age and registrar? GET /v1/domain/age?domain=example.com is $0.005.
What you get back
{
"domain": "example.com",
"score": 100,
"letter": "A",
"summary": "example.com scores 100/100 (A): 6 pass, 0 warn, 0 fail, 6 info. Nothing to fix.",
"checks": [
{ "check": "dmarc", "label": "DMARC", "grade": "pass",
"finding": "DMARC enforces p=reject on 100% of mail.", "fix": null },
{ "check": "mta_sts", "label": "MTA-STS", "grade": "info",
"finding": "Not applicable: the domain takes no mail (no MX), and no MTA-STS is published.", "fix": null },
{ "check": "registration", "label": "Registration (registrar and age)", "grade": "pass",
"finding": "Registered 1995-08-14 via RESERVED-Internet Assigned Numbers Authority (IANA 376), 11389 days old, expires 2027-08-13.", "fix": null }
]
}