# Lookproof

> Email, DNS and website security checks for developers and AI agents: SPF, DMARC, DKIM, MX, MTA-STS, BIMI, DNSSEC, CAA, TLS certificates, security headers, RDAP and full domain and site health reports. Lookproof is a REST API described by OpenAPI, not an A2A message endpoint: call the skills' HTTPS endpoints directly. Pay per request with x402 (a request without payment gets 402 with the exact price, USDC on Base) or send an API key; an MCP server (uvx lookproof-mcp) is described in mcp.json.

- **Domain**: `api.lookproof.dev`
- **Provider**: Lookproof (https://lookproof.dev)
- **A2A protocol version**: 1.0
- **Kind**: paid_api
- **Live-responds (last probe)**: None
- **Signed card**: False
- **Streaming**: False
- **Quality score**: 90%
- **Payment protocol**: x402 · network `eip155:8453` · ≥ $0.002
- **Wallet**: `0x5be2be9f95549a2d69951d24a2b3901d1df1bc05`

## Skills
- **CAA record check** — Evaluate a domain's CAA records (RFC 8659), climbing to parent names up to the registrable domain when the name has none: allowed issuers for normal and wildcar
- **DNS resolver comparison** — Ask Cloudflare and Google the same DNS question, each alone and uncached, and compare response codes and records; different codes (such as SERVFAIL from one) ar
- **DNSSEC check** — Report a domain's DNSSEC status (secure, insecure, bogus or unknown) as validated by public resolvers, with DS and DNSKEY algorithms, deprecated algorithms, SHA
- **HTTPS record check** — Read a name's HTTPS records (RFC 9460, SVCB): priority, target, AliasMode or ServiceMode, alpn (h3, h2), port, IPv4 and IPv6 hints and whether ECH is published,
- **IDN converter** — Convert a domain name between Unicode and punycode (A-labels) and check it against IDNA2008 and UTS 46: disallowed characters, bidi, context and hyphen rules, l
- **DNS lookup** — Resolve chosen DNS record types (A, AAAA, CNAME, MX, NS, TXT, SOA, CAA, SRV) for a name through public resolvers, with TTL, observation time and the resolver th
- **Name server check** — Check a zone's name servers: the NS set, the IPv4 and IPv6 addresses of up to eight servers, a single server, servers that do not resolve, all addresses in one 
- **DNS provider lookup** — Find which DNS provider a domain's NS records point to (Cloudflare, Route 53, Azure DNS, Google Cloud DNS, GoDaddy, Namecheap, NS1, Hetzner, OVHcloud and more) 
- **SOA record check** — Check a zone's SOA record through public resolvers: primary server, contact name, serial (YYYYMMDDnn or counter), refresh, retry, expire and negative caching TT
- **DNS TTL check** — Show the TTL of A, AAAA, MX, NS, TXT, CAA and SOA records with its source: exact from a validated DNSSEC signature (RRSIG Original TTL) or the resolver's remain
- **Domain verification records** — List the domain verification tokens in a domain's apex TXT records (google-site-verification, MS=, Atlassian, Facebook, Apple, Adobe, DocuSign, Stripe and more)
- **Wildcard DNS check** — Find out whether a DNS zone has a wildcard (RFC 4592): A, AAAA, TXT and MX of a random, uncached name under the domain through public resolvers, with a warning 
- **Zone file checker** — Check a pasted DNS zone file (RFC 1035 master format, up to 64 KiB) with $ORIGIN and $TTL: unreadable lines, SOA and NS at the apex, CNAME at the apex or beside
- **Domain health check** — One report on a domain's mail and DNS security: MX, SPF, DMARC, common DKIM selectors, MTA-STS with TLS-RPT, DNSSEC, reverse DNS of the mail servers, BIMI and C
- **RDAP domain lookup** — Look up a domain's registration at its registry over RDAP (RFC 9083, servers from the IANA bootstrap file): registrar and IANA id, creation, change and expiry d
- **Set-Cookie parser** — Parse a pasted Set-Cookie header as RFC 6265bis does: Secure, HttpOnly, SameSite, Partitioned, __Host- and __Secure- prefix rules, Domain, Path, Expires and Max
- **CSP header parser** — Parse a pasted Content-Security-Policy value as CSP Level 3 does: directives and sources per policy, 'unsafe-inline' and 'unsafe-eval', wildcard and scheme-only
- **HSTS header parser** — Parse a pasted Strict-Transport-Security value as RFC 6797 does: whether browsers accept it, max-age, includeSubDomains, preload, and which hstspreload.org head
- **Security headers check** — Follow a site's redirect chains from http:// and https:// and read the security headers of the final HTTPS response: HSTS with preload readiness, Content-Securi
- **CIDR calculator** — Compute a CIDR block: network, first and last address, number of addresses, netmask and host mask, and whether the input had host bits set (192.0.2.5/24). IPv4 
- **IP in CIDR check** — Check one IPv4 or IPv6 address against up to 100 CIDR blocks and get, for each, whether it contains the address, plus the blocks that do; blocks of the other IP
- **IP address info** — Classify an IPv4 or IPv6 address by IANA's special-purpose registries (private, loopback, link-local, shared, documentation, 6to4, Teredo, NAT64 and more, with 
- **IP range to CIDR** — Turn a start and end IPv4 or IPv6 address into the smallest list of CIDR blocks that covers exactly that range (at most 62 for IPv4, 254 for IPv6). Offline. Use
- **Subnet calculator** — Split an IPv4 or IPv6 CIDR block into subnets of a longer prefix, in order, at most 256 at a time; a larger split is refused before anything is computed. Offlin
- **BIMI record check** — Check a domain's BIMI record (<selector>._bimi, default selector, with fallback to the organisational domain): v=BIMI1 syntax, HTTPS logo and certificate URLs, 
- **BIMI record parser** — Parse a pasted BIMI record: v=BIMI1, the l= logo and a= certificate tags, repeated or missing tags, HTTPS URLs, the .svg logo path and a missing mark certificat
- **Mail configuration check** — One report on a domain's mail setup: MX, SPF and DMARC, plus DKIM for the selectors you give, with coded findings, an overall status and a spoofing protection c
- **Bulk mail configuration check** — Run the mail configuration check (MX, SPF, DMARC) on up to 20 domains in one request, each with its spoofing protection category. Results keep the input order, 
- **DKIM record check** — Fetch and validate the DKIM public key record at selector._domainkey for a domain: key type, key size, revocation and syntax, with coded findings. Use when an a
- **DKIM selector finder** — Try 31 common DKIM selectors (Google, Microsoft 365, Mailchimp, SendGrid, Mailgun, Zoho, Proton, Fastmail, mailbox.org, Mailjet, Amazon SES and generic names) f
- **DMARC check** — Look up the DMARC record of a domain or its organisational domain and explain policy, subdomain policy, alignment and reporting addresses, with coded findings. 
- **DMARC record parser** — Parse a pasted DMARC record without DNS (RFC 9989): p, sp, np, psd, t, adkim, aspf, rua and ruf, historic and unknown tags, with the same coded findings as the 
- **MTA-STS and TLS-RPT check** — Check a domain's MTA-STS setup (RFC 8461): the _mta-sts record, the HTTPS policy file with certificate check and no redirects, mode, max_age and whether every M
- **MTA-STS policy parser** — Parse a pasted MTA-STS policy file (RFC 8461) as a sending server would: version, mode, mx patterns and max_age, lines that do not parse, testing or none mode a
- **MX lookup** — List a domain's mail servers in preference order and detect null MX (RFC 7505) and MX targets that do not resolve, with coded findings. Use when an agent must f
- **Mail provider detection** — Name the mail providers a domain uses from its MX hosts and SPF include tree: the mailbox provider behind the primary MX, inbound gateways and sending services,
- **Reverse DNS check for mail servers** — Check reverse DNS for a domain's mail servers: up to five MX hosts, their IPv4 and IPv6 addresses, each PTR name and whether it resolves back to the same addres
- **SPF check** — Parse and evaluate a domain's SPF record: the include and redirect tree, qualifiers and the RFC 7208 limit of ten DNS lookups, with coded findings. Use when an 
- **SPF flattening check** — Unfold a domain's SPF policy (RFC 7208) into merged IPv4 and IPv6 blocks: include and redirect followed as a receiver counts them (10 lookups, 2 void lookups, P
- **SPF record parser** — Parse a pasted SPF record without DNS (RFC 7208): mechanisms with qualifiers and values, modifiers, syntax errors, the all policy and the number of terms that n
- **Email spoofing check** — Read how strong a domain's DMARC policy (RFC 9989) is: protected (reject), partial (quarantine), monitoring (none), unprotected or broken, plus whether it has g
- **TLS-RPT check** — Check a domain's TLS-RPT record (RFC 8460) at _smtp._tls: one v=TLSRPTv1 record with exactly one rua tag of mailto: or https: report addresses. Use when an agen
- **TLS-RPT record parser** — Parse a pasted TLS-RPT record (RFC 8460): v=TLSRPTv1, exactly one rua tag and whether each report address is a mailto: or https: URI. Offline. Use when an agent
- **Site health check** — One report on a website's security basics: the TLS certificate on port 443 (trust, name, expiry, key), the redirect chains from http:// and https:// with HSTS, 
- **TLS certificate check** — Check the TLS certificate a domain serves on port 443: whether it chains to a trusted root, matches the name (RFC 9525) and when it expires, with issuer, chain,
- **CSR decoder** — Decode one pasted PEM certificate signing request (PKCS#10): subject, DNS and IP names, key type and size, signature algorithm and whether the signature matches
- **PEM certificate decoder** — Decode one pasted PEM X.509 certificate: subject, issuer, validity and days left, DNS and IP names, key type and size, signature algorithm, CA flag, key usages,

## URLs
- Agent card: https://api.lookproof.dev/.well-known/agent-card.json
- Page (HTML): https://agenstry.com/agents/api.lookproof.dev
- Documentation: https://lookproof.dev/agents