Auth Posture

One API call answers two questions: can this domain receive email? and can anyone send mail pretending to be this domain? MX, SPF, DMARC, DKIM and disposable checks, in a single request.

1. Try it now — no signup, 3 audits/day free

2. Then get a free key — 50 audits/month, no card

Recommended next step. A free key raises you from 3 audits/day to 50 audits/month. Just an email address — no card, no password. The same key keeps working if you ever move to a paid plan.

Get a free key →

3. API

GET /api/audit?domain=example.com

{
  "domain": "example.com",
  "can_receive": true,
  "can_be_spoofed": true,
  "score": 42,
  "reasons": [
    "DMARC policy is p=none: mail from this domain can be spoofed..."
  ],
  "checks": { "mx": {...}, "spf": {...}, "dmarc": {...}, "dkim": {...}, "disposable": false }
}

MCP tool

Endpoint: https://auth-posture.rowb.app/mcp — tool audit_domain. List tools without a key; calls need a free key.

Want more than 3 audits/day? Get a free key — 50 audits/month, just an email address.

Why

Sender-side posture tools check one half. Address verifiers check the other half. This is both, in one call — built for agents that send mail.