Auth Posture

One API call answers two questions: can this domain receive email? and can anyone send mail pretending to be this domain? MX, SPF, DMARC, DKIM and disposable checks, in a single request.

Try it now — no signup, 3 audits/day free

API

GET /api/audit?domain=example.com

{
  "domain": "example.com",
  "can_receive": true,
  "can_be_spoofed": true,
  "score": 42,
  "reasons": [
    "DMARC policy is p=none: mail from this domain can be spoofed..."
  ],
  "checks": { "mx": {...}, "spf": {...}, "dmarc": {...}, "dkim": {...}, "disposable": false }
}

MCP tool

Endpoint: https://auth-posture.rowb.app/mcp — tool audit_domain. List tools without a key; calls need a free key.

Plans

Anonymous: 3 audits/day. Free key: 50 audits/month. Starter $9/mo: 1,000 audits/month.

Why

Sender-side posture tools check one half. Address verifiers check the other half. This is both, in one call — built for agents that send mail.