Sample on example input

Email SPF/DMARC/BIMI & Domain Trust Composite Suite

Composite 6-check domain deliverability & trust audit chaining SPF/DMARC lookup limits, BIMI readiness, TLS cipher suite, robots.txt, sitemap.xml, and webhook HMAC.

Free sample: real output of this suite run on a made-up example configuration (example.com hosts, illustrative values chosen to show what findings look like). It is not an audit of any real system. The paid call runs the same logic on the parameters you send.

What you get

Executive grade C, posture score 67/100 on this example input
6 sub-check results; failed on this example:

spf_dmarc
bimi_readiness

Prioritized remediation checklist and disclaimer

Example input

{
  "dmarc_policy": "none",
  "spf_record": "v=spf1 include:_spf.example.com ?all",
  "dmarc_record": "v=DMARC1; p=none"
}

Parameters this suite reads

All parameters this suite reads. Pass your real values as query or JSON parameters; omitted ones use defaults. The suite evaluates the values you pass; it does not crawl or scan live URLs.

spf_record, dmarc_record, dmarc_policy, dmarc_pct, has_svg_tiny_ps_logo, cipher_list, user_agent, allow, disallow, sitemap, loc, lastmod, changefreq, priority, payload, timestamp, test_secret, signature

How to call it (0.05 USDC)

x402: Returns HTTP 402 with a base64 PAYMENT-REQUIRED header (x402 v2, USDC on Base, eip155:8453). Use any x402 v2 client (it signs an EIP-3009 authorization and retries with PAYMENT-SIGNATURE). Fallback: send the USDC yourself, then retry with header X-PAYMENT-TX: <tx hash>.

curl -i 'https://bot-bazaar.fly.dev/v1/x402/suite/email-and-domain-deliverability?dmarc_policy=none&spf_record=v%3Dspf1+include%3A_spf.example.com+%3Fall&dmarc_record=v%3DDMARC1%3B+p%3Dnone'

Prepaid key:

curl -s -H 'X-Bazaar-Key: bz_live_YOUR_KEY' 'https://bot-bazaar.fly.dev/v1/x402/suite/email-and-domain-deliverability?dmarc_policy=none&spf_record=v%3Dspf1+include%3A_spf.example.com+%3Fall&dmarc_record=v%3DDMARC1%3B+p%3Dnone'

MCP (streamable HTTP, tool suite_email_and_domain_deliverability):

curl -s https://bot-bazaar.fly.dev/mcp -H 'content-type: application/json' -H 'X-Bazaar-Key: bz_live_YOUR_KEY' -d '{"jsonrpc": "2.0", "id": 1, "method": "tools/call", "params": {"name": "suite_email_and_domain_deliverability", "arguments": {"dmarc_policy": "none", "spf_record": "v=spf1 include:_spf.example.com ?all", "dmarc_record": "v=DMARC1; p=none"}}}'

OpenAI-compatible

Not routed by the chat-completions endpoint; call the x402 route or the MCP tool.

Full sample report (JSON)

{
  "suite": "email-and-domain-deliverability",
  "tool": "suite/email-and-domain-deliverability",
  "title": "Domain Trust, SPF/DMARC/BIMI Deliverability & Webhook Security Suite",
  "valid": true,
  "composite_risk_score": 33,
  "composite_posture_score": 67,
  "executive_grade": "C",
  "sub_check_count": 6,
  "sub_checks": {
    "spf_dmarc": {
      "valid": true,
      "email_auth_strong": false,
      "spf_dns_lookups": 1,
      "checks": {
        "spf_v1_prefix": true,
        "spf_dns_lookups_lte_10": true,
        "spf_strict_all": false,
        "dmarc_enforcing": false
      }
    },
    "bimi_readiness": {
      "valid": true,
      "bimi_ready": false,
      "dmarc_policy": "none",
      "dmarc_pct": 100
    },
    "tls_cipher": {
      "valid": true,
      "grade": "A",
      "cipher_list": "TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:ECDHE-RSA-AES128-GCM-SHA256",
      "checks": {
        "has_aead_gcm_or_chacha20": true,
        "no_rc4_or_3des": true,
        "no_null_or_export": true
      }
    },
    "robots_txt": {
      "valid": true,
      "user_agent": "*",
      "allow": "/",
      "disallow": [
        "/v1/admin/",
        "/v1/bots/me"
      ],
      "sitemap": "https://bot-bazaar.fly.dev/sitemap.xml",
      "checks": {
        "allows_root_crawl": true,
        "protects_admin_paths": true,
        "https_sitemap_present": true
      }
    },
    "sitemap_entry": {
      "valid": true,
      "loc": "https://bot-bazaar.fly.dev/llms.txt",
      "lastmod": "2026-10-25",
      "changefreq": "daily",
      "priority": "0.9",
      "checks": {
        "https_canonical_loc": true,
        "iso_date_lastmod": true,
        "valid_changefreq": true,
        "valid_priority_range": true
      }
    },
    "webhook_hmac": {
      "signature_matches": true,
      "computed_hmac_sha256": "eafa95333bac6aef0bc19f9705abe137e98fbe7512a44a55babf196d2216f02a",
      "signed_payload_format": "timestamp.payload"
    }
  },
  "passed_sub_checks": [
    "tls_cipher",
    "robots_txt",
    "sitemap_entry",
    "webhook_hmac"
  ],
  "failed_sub_checks": [
    "spf_dmarc",
    "bimi_readiness"
  ],
  "informational_sub_checks": [],
  "prioritized_remediation_checklist": [
    "Keep SPF DNS lookups <= 10 with -all and enforce DMARC p=reject (pct=100) for BIMI readiness.",
    "Verify timestamped HMAC-SHA256 signatures in constant time on all incoming webhooks.",
    "Publish canonical HTTPS URLs in sitemap.xml and protect /v1/admin/ in robots.txt."
  ],
  "remediation_note": "General hardening checklist for this suite; failed_sub_checks lists the findings specific to the input you passed.",
  "input_note": "This suite evaluates the configuration values passed as query or JSON parameters; it does not crawl or scan live URLs. Omitted parameters fall back to the documented defaults.",
  "disclaimer": "Automated composite analytical & schema audit only \u2014 not legal advice, not financial or investment advice, not tax advice, and not a formal third-party security certification.",
  "generated_at": 1793508388
}

This sample as JSON · All samples