# DomainRef

> Use when mail lands in spam, before an email campaign, for vendor due diligence or to confirm a Microsoft 365 tenant: graded SPF, DKIM, DMARC, MX, MTA-STS, DNSSEC, CAA, TLS and domain age, each with the exact fix record. Non-intrusive. $0.01 per domain.

## Endpoints
- GET https://www.domainref.dev/v1/domain/check?domain={domain} - $0.01 per domain. The full graded report.
- GET https://www.domainref.dev/v1/domain/age?domain={domain} - $0.005 per domain. Not for registries without RDAP, e.g. .za/.co.za, .me, .de, .io, .eu: refused free (422). Use when you need to know which registrar holds a domain, how old it is, and whether it is a risky newly-registered domain. $0.005.
Both are x402 (USDC on Base, eip155:8453). No key, no signup.

## What the check covers
- SPF: One record, at most 10 DNS lookups and 2 void lookups, no ptr. ~all passes when DMARC enforces.
- DKIM: 46 common selectors probed in parallel, including Microsoft 365 selector1/selector2, Google, Zoho, Proton, Fastmail, Mandrill, Mailjet, SendGrid, Amazon SES and Mimecast. Flags 1024-bit keys.
- DMARC: Policy, sp=, pct, reports (rua) and external report authorisation. A hostname falls back to its organisational domain (Public Suffix List).
- MX: Present and resolvable. Only an explicit null MX (0 .) counts as no mail.
- MTA-STS: The _mta-sts TXT record and the HTTPS policy on mta-sts.<domain>: mode, mx coverage, max_age.
- TLS-RPT: A _smtp._tls record with a valid rua.
- DNSSEC: DS at the parent and a validated answer.
- CAA: Which CAs may issue, and whether the current certificate's CA is allowed.
- Website certificate: The HTTPS certificate on port 443: issuer, days to expiry, hostname match, chain. A small part of the score.
- Registration: Registrar (name and IANA ID only), age, expiry and hold flags from the registry's RDAP. Under 30 days old fails.
- Microsoft 365: Tenant detection from Microsoft's public sign-in discovery endpoints. Info only.
- BIMI: default._bimi record. Info only, never scored.

Each check returns grade (pass, warn, fail or info), finding, and fix: the exact record or step to apply. Info checks carry their fix but do not move the 0-100 score, so a domain is only marked down for what it deployed and got wrong.

## Paying
Call without payment and you get HTTP 402 with a PAYMENT-REQUIRED header. Any x402 client signs the USDC payment and retries with PAYMENT-SIGNATURE. Bad input, a domain that does not exist, a private-only domain, a DNS outage and rate limits are refused free (400, 404, 422, 429, 503) before any charge. HEAD is a free 402 preview and is never charged.

## Coverage note
The age endpoint refuses registries without RDAP, e.g. .za/.co.za, .me, .de, .io, .eu, free (422). The full check still runs for them and shows registration as info.

## Non-intrusive
Only the ordinary requests a browser or mail server makes: public DNS over HTTPS, the registry's RDAP, Microsoft's public sign-in discovery, one TLS handshake on port 443 of the domain and, when published, the MTA-STS policy over HTTPS on port 443. No port scans, no other ports.

## Privacy
The DomainRef app does not store queried domains; our firewall log keeps request URLs (with the domain) for about 6 months. To answer, the domain is sent to Cloudflare and Google public DNS, to Microsoft's discovery endpoints, to the registry's RDAP service and to the domain's own servers on port 443. Those lookup providers never learn who asked. Our CDN (Cloudflare) necessarily sees your IP and the full request. Details: https://www.domainref.dev/privacy. Terms: https://www.domainref.dev/terms. Pricing: https://www.domainref.dev/pricing.

## Machine-readable
- OpenAPI: https://www.domainref.dev/openapi.json
- x402 discovery: https://www.domainref.dev/.well-known/x402