DomainRef - domain and email security check

PAID ($0.01). Use when mail lands in spam, before an email campaign, for vendor due diligence or to confirm a Microsoft 365 tenant: graded SPF, DKIM, DMARC, MX, MTA-STS, DNSSEC, CAA, TLS and domain age, plus BIMI and blocklist info, each with the exact fix record. Non-intrusive. $0.01 per domain. Returns a 0-100 score and, per check (spf, dkim, dmarc, mx, tls = website certificate, m365, registration, mta_sts, tls_rpt, dnssec, caa, bimi, dnsbl = UCEPROTECT blocklist), a pass/warn/fail/info grade, the finding and the exact record or step that fixes it. Info checks do not move the score. Invalid, nonexistent or private-only domains are refused free. MCP: pass api_key (an Afriref key, card credit at https://afriref.dev/pricing); per-call x402/MPP payment is HTTP only, so without a key the result is an api_key_required error naming the HTTP endpoint.

{
  "type": "object",
  "properties": {
    "domain": {
      "type": "string",
      "description": "Domain or hostname, e.g. example.com (no URL, no IP)"
    },
    "api_key": {
      "description": "API key (bypasses x402; metered for invoicing)",
      "type": "string"
    }
  },
  "required": [
    "domain"
  ],
  "$schema": "http://json-schema.org/draft-07/schema#"
}

{
  "type": "object",
  "properties": {
    "error": {
      "description": "Present on a free refusal or error; no charge"
    },
    "explanation": {},
    "no_charge": {
      "type": "boolean"
    },
    "how_to_pay": {
      "type": "array",
      "items": {
        "type": "string"
      }
    },
    "http_endpoint": {
      "type": "string"
    },
    "price_usd": {
      "type": "number"
    },
    "fix": {
      "type": [
        "string",
        "null"
      ]
    },
    "diagnosis": {},
    "domain": {
      "type": "string"
    },
    "checked_at": {
      "type": "string"
    },
    "score": {
      "type": "number"
    },
    "letter": {
      "type": "string"
    },
    "summary": {
      "type": "string"
    },
    "checks": {
      "type": "array",
      "items": {
        "type": "object",
        "properties": {
          "check": {
            "type": "string"
          },
          "grade": {
            "type": "string"
          },
          "finding": {
            "type": "string"
          },
          "fix": {
            "type": [
              "string",
              "null"
            ]
          }
        },
        "additionalProperties": {}
      }
    },
    "notes": {
      "type": "array",
      "items": {
        "type": "string"
      }
    }
  },
  "$schema": "http://json-schema.org/draft-07/schema#",
  "additionalProperties": {},
  "description": "Domain and email security report: 0-100 score, letter, summary and one entry per check with grade, finding and fix. A refusal (invalid or unknown domain, broken DNS, api_key_required) is isError with error and explanation; nothing is charged"
}

PAID ($0.005). Not for registries without RDAP, e.g. .za/.co.za, .me, .de, .io, .eu: refused free (422). Use when you need to know which registrar holds a domain, how old it is, and whether it is a risky newly-registered domain. $0.005. From the registry's RDAP: registrar name and IANA ID (no registrant or contact data), created, expires, last changed, status flags, DNSSEC delegation, nameservers; fail under 30 days old or expired, warn under 180 days, expiring within 30 days or on hold. A registry without RDAP is refused free. MCP: pass api_key (an Afriref key, card credit at https://afriref.dev/pricing); per-call x402/MPP payment is HTTP only, so without a key the result is an api_key_required error naming the HTTP endpoint.

{
  "type": "object",
  "properties": {
    "domain": {
      "type": "string",
      "description": "Domain or hostname, e.g. example.com (no URL, no IP)"
    },
    "api_key": {
      "description": "API key (bypasses x402; metered for invoicing)",
      "type": "string"
    }
  },
  "required": [
    "domain"
  ],
  "$schema": "http://json-schema.org/draft-07/schema#"
}

{
  "type": "object",
  "properties": {
    "error": {
      "description": "Present on a free refusal or error; no charge"
    },
    "explanation": {},
    "no_charge": {
      "type": "boolean"
    },
    "how_to_pay": {
      "type": "array",
      "items": {
        "type": "string"
      }
    },
    "http_endpoint": {
      "type": "string"
    },
    "price_usd": {
      "type": "number"
    },
    "fix": {
      "type": [
        "string",
        "null"
      ]
    },
    "diagnosis": {},
    "domain": {
      "type": "string"
    },
    "checked_at": {
      "type": "string"
    },
    "grade": {
      "type": "string"
    },
    "finding": {
      "type": "string"
    },
    "registration": {},
    "notes": {
      "type": "array",
      "items": {
        "type": "string"
      }
    }
  },
  "$schema": "http://json-schema.org/draft-07/schema#",
  "additionalProperties": {},
  "description": "Registration from the registry's RDAP: grade, finding, fix and registrar, created, expires, status and nameservers. A refusal (invalid domain, registry without RDAP, api_key_required) is isError with error and explanation; nothing is charged"
}