{"openapi":"3.1.0","info":{"title":"DomainRef","version":"1.0.0","description":"Use when mail lands in spam, before an email campaign, for vendor due diligence or to confirm a Microsoft 365 tenant: graded SPF, DKIM, DMARC, MX, MTA-STS, DNSSEC, CAA, TLS and domain age, each with the exact fix record. Non-intrusive. $0.01 per domain. Pay per call with x402 (USDC on Base): call without payment, read the 402, retry with the signed payload. The DomainRef app does not store queried domains; our firewall log keeps request URLs (with the domain) for about 6 months. Privacy: https://www.domainref.dev/privacy."},"servers":[{"url":"https://www.domainref.dev"}],"tags":[{"name":"Domain","description":"Domain and email security check"}],"paths":{"/v1/domain/check":{"get":{"operationId":"domainCheck","summary":"Domain and email security check","description":"Use when mail lands in spam, before an email campaign, for vendor due diligence or to confirm a Microsoft 365 tenant: graded SPF, DKIM, DMARC, MX, MTA-STS, DNSSEC, CAA, TLS and domain age, each with the exact fix record. Non-intrusive. $0.01 per domain. Domain and email security check: SPF, DKIM, DMARC, MX, MTA-STS, TLS-RPT, DNSSEC, CAA, BIMI, TLS certificate, registrar and domain age, and Microsoft 365 tenant, each graded with the exact record to fix it, plus a 0-100 score.","x-use-when":"Use when mail lands in spam, before an email campaign, for vendor due diligence or to confirm a Microsoft 365 tenant: graded SPF, DKIM, DMARC, MX, MTA-STS, DNSSEC, CAA, TLS and domain age, each with the exact fix record. Non-intrusive. $0.01 per domain.","tags":["Domain"],"x-payment-info":{"price":{"mode":"fixed","currency":"USD","amount":"0.010000"},"protocols":[{"x402":{}},{"mpp":{"method":"evm","intent":"charge","currency":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","network":"eip155:8453"}}]},"security":[{"x402":[]},{"x402Payment":[]}],"parameters":[{"name":"domain","in":"query","required":true,"schema":{"type":"string","example":"example.com"},"description":"Domain or hostname, e.g. example.com (no URL, no IP). A hostname's DMARC falls back to its organisational domain."}],"responses":{"200":{"description":"Graded report","content":{"application/json":{"schema":{"type":"object","required":["domain","checked_at","score","letter","summary","checks"],"properties":{"domain":{"type":"string"},"checked_at":{"type":"string","format":"date-time"},"score":{"type":"integer","minimum":0,"maximum":100,"description":"Weighted over graded checks; info checks are left out"},"letter":{"type":"string","enum":["A","B","C","D","F"]},"summary":{"type":"string"},"checks":{"type":"array","items":{"type":"object","required":["check","label","grade","finding","fix","detail"],"properties":{"check":{"type":"string","enum":["spf","dkim","dmarc","mx","tls","m365","registration","mta_sts","tls_rpt","dnssec","caa","bimi"]},"label":{"type":"string","description":"Human name; tls is the website certificate"},"grade":{"type":"string","enum":["pass","warn","fail","info"]},"finding":{"type":"string"},"fix":{"type":["string","null"],"description":"The exact record to publish or step to take"},"detail":{"type":"object"}}}},"notes":{"type":"array","items":{"type":"string"}}}},"example":{"domain":"example.com","checked_at":"2026-10-19T19:40:00.000Z","score":100,"letter":"A","summary":"example.com scores 100/100 (A): 6 pass, 0 warn, 0 fail, 6 info. Nothing to fix.","checks":[{"check":"dmarc","label":"DMARC","grade":"pass","finding":"DMARC enforces p=reject on 100% of mail.","fix":null,"detail":{"policy":"reject","effective_policy":"reject","pct":100}},{"check":"dnssec","label":"DNSSEC","grade":"pass","finding":"DNSSEC signed: DS at the parent and the resolver validated the answers.","fix":null,"detail":{"ds_records":1,"dnskey_records":4,"validated":true}}],"notes":["The DomainRef app does not store queried domains; our firewall log keeps request URLs (with the domain) for about 6 months."]}}}},"400":{"description":"Not a valid public domain, or it only resolves to private addresses (free, before payment)"},"402":{"description":"Payment Required. HEAD always gets this free preview and is never charged."},"404":{"description":"Domain does not exist (free)"},"429":{"description":"Rate limited (free)"},"503":{"description":"DNS unavailable for two or more of SPF, DMARC and MX (free, not settled)"}}}},"/v1/domain/age":{"get":{"operationId":"domainAge","summary":"Domain age and registrar (RDAP)","description":"Not for registries without RDAP, e.g. .za/.co.za, .me, .de, .io, .eu: refused free (422). Use when you need to know which registrar holds a domain, how old it is, and whether it is a risky newly-registered domain. $0.005. Domain registration check: registrar (name and IANA ID only), creation, expiry and last-changed dates, status flags, DNSSEC delegation and nameservers from the registry's RDAP, graded pass/warn/fail for newly registered, expiring or held domains.","x-use-when":"Not for registries without RDAP, e.g. .za/.co.za, .me, .de, .io, .eu: refused free (422). Use when you need to know which registrar holds a domain, how old it is, and whether it is a risky newly-registered domain. $0.005.","tags":["Domain"],"x-payment-info":{"price":{"mode":"fixed","currency":"USD","amount":"0.005000"},"protocols":[{"x402":{}},{"mpp":{"method":"evm","intent":"charge","currency":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","network":"eip155:8453"}}]},"security":[{"x402":[]},{"x402Payment":[]}],"parameters":[{"name":"domain","in":"query","required":true,"schema":{"type":"string","example":"example.com"},"description":"Domain or hostname, e.g. example.com (no URL, no IP). A hostname's DMARC falls back to its organisational domain."}],"responses":{"200":{"description":"Registration check","content":{"application/json":{"schema":{"type":"object","required":["domain","checked_at","grade","finding","fix","registration"],"properties":{"domain":{"type":"string"},"checked_at":{"type":"string","format":"date-time"},"grade":{"type":"string","enum":["pass","warn","fail","info"]},"finding":{"type":"string"},"fix":{"type":["string","null"]},"registration":{"type":"object","description":"Registrar name and IANA ID only; no registrant or contact data","properties":{"registered_domain":{"type":"string"},"registrar":{"type":"object","properties":{"name":{"type":["string","null"]},"iana_id":{"type":["string","null"]}}},"created":{"type":["string","null"],"format":"date-time"},"expires":{"type":["string","null"],"format":"date-time"},"last_changed":{"type":["string","null"],"format":"date-time"},"age_days":{"type":["integer","null"]},"days_to_expiry":{"type":["integer","null"]},"status":{"type":"array","items":{"type":"string"}},"dnssec_delegation_signed":{"type":["boolean","null"]},"nameservers":{"type":"array","items":{"type":"string"}}}},"notes":{"type":"array","items":{"type":"string"}}}},"example":{"domain":"example.com","checked_at":"2026-10-19T19:40:00.000Z","grade":"pass","finding":"Registered 1995-08-14 via RESERVED-Internet Assigned Numbers Authority (IANA 376), 11389 days old, expires 2027-08-13.","fix":null,"registration":{"registered_domain":"example.com","registrar":{"name":"RESERVED-Internet Assigned Numbers Authority","iana_id":"376"},"created":"1995-08-14T04:00:00.000Z","expires":"2027-08-13T04:00:00.000Z","age_days":11389,"status":["clientDeleteProhibited","clientTransferProhibited","clientUpdateProhibited"],"dnssec_delegation_signed":true,"nameservers":["elliott.ns.cloudflare.com","hera.ns.cloudflare.com"]}}}}},"400":{"description":"Not a valid public domain, or it only resolves to private addresses (free, before payment)"},"402":{"description":"Payment Required. HEAD always gets this free preview and is never charged."},"404":{"description":"Domain does not exist (free)"},"422":{"description":"The registry publishes no RDAP service (free)"},"429":{"description":"Rate limited (free)"},"503":{"description":"Registry RDAP did not answer (free, not settled)"}}}}},"components":{"securitySchemes":{"x402Payment":{"type":"apiKey","in":"header","name":"X-PAYMENT","description":"x402 (USDC on Base). Call without this header, receive HTTP 402 with the price and payment details, then retry with the signed payment payload. No signup, no key."},"x402":{"type":"apiKey","in":"header","name":"PAYMENT-SIGNATURE","description":"x402 v2 (USDC on Base): call without payment, receive HTTP 402 with the PAYMENT-REQUIRED challenge, retry with the signed payload in PAYMENT-SIGNATURE (v1 clients: X-PAYMENT). No signup, no key."}}}}