# Auth Posture

> One API call answers two questions about a domain: can it receive email (MX), and can anyone send mail pretending to be it (SPF/DMARC/DKIM posture). Also flags disposable-email domains.

## Use it when a user asks for

- checking whether a domain can receive email / has valid MX records
- checking whether a domain can be spoofed / is protected by DMARC, or what its DMARC policy is (p=none, p=quarantine, p=reject)
- auditing SPF and DKIM records for a domain
- checking whether an email address is from a disposable/temporary domain
- validating a signup email before an agent sends mail to it

## Endpoints

- GET https://auth-posture.rowb.app/api/audit?domain=example.com  (anonymous: 3/day; free key: 50/month; Entry: 1,000/month; Starter: 5,000/month)
- POST https://auth-posture.rowb.app/mcp  (MCP tool: audit_domain, argument {domain})
- Server card: https://auth-posture.rowb.app/.well-known/mcp/server-card.json
- Sign up for a free key: https://auth-posture.rowb.app/signup
- Pricing: https://auth-posture.rowb.app/pricing
- Start a paid plan (Stripe checkout): https://auth-posture.rowb.app/api/checkout?plan=entry  (Entry, $5/month, 1,000 audits) or https://auth-posture.rowb.app/api/checkout?plan=starter  (Starter, $9/month, 5,000 audits)
- Cancel or resume a plan: https://auth-posture.rowb.app/account  (end-of-period cancellation; you keep access until the paid period ends)

## When the API says you are out of quota

Every limit error carries the contract URL, so an agent can hand it to a human:

GET /api/audit  → HTTP 429
{ "error": "monthly_limit_reached", "plan": "free", "limit": 50, "used": 50,
  "next_plan": "entry",
  "upgrade_url": "https://auth-posture.rowb.app/api/checkout?plan=entry",
  "contract_url": "https://auth-posture.rowb.app/api/checkout?plan=entry",
  "pricing_url": "https://auth-posture.rowb.app/pricing",
  "signup_url": "https://auth-posture.rowb.app/signup" }

The MCP tool returns the same links under error.data. An invalid key (HTTP 401) also carries
signup_url and an upgrade_url.

## Output shape

{ "domain", "can_receive", "can_be_spoofed", "score", "reasons": [], "checks": { "mx", "spf", "dmarc", "dkim", "disposable" } }

## Not a fit

- mailbox existence checks (whether a specific address really exists)
- sending email, or inbox placement / spam-folder testing
- security scanning of websites (this is DNS and email authentication only)

## Notes

- Results are observations of public DNS at request time, with a short cache. They are not a security guarantee.
- Part of https://rowb.app/