# DNSDeets

> Free domain security scanner: email authentication (SPF/DKIM/DMARC/MTA-STS), DNS hygiene, TLS, HTTP security headers, and registration health. One scan returns a 0-100 score with an itemized, explainable findings ledger. Every finding carries plain-English text, technical detail, ordered fix steps, and a docs URL.

## API (no auth required for anonymous use)

- Scan a domain: GET https://dnsdeets.com/api/v1/scan?domain=example.com (JSON; cached 10 min)
- Streaming scan: GET https://dnsdeets.com/api/v1/scan/stream?domain=example.com (SSE)
- Check one DKIM selector: POST https://dnsdeets.com/api/v1/dkim {"domain":"...","selector":"..."}
- Check catalog (all check ids, severities, docs): GET https://dnsdeets.com/api/v1/checks
- OpenAPI 3.1 spec: https://dnsdeets.com/api/v1/openapi.json
- MCP server (streamable HTTP, stateless): https://dnsdeets.com/api/mcp with tools scan_domain, explain_check, list_monitors

## Notes for agents

- Rate limits: ~20 scans/10 min per IP; honor Retry-After on HTTP 429.
- Fields the scan could not observe are null with assessed:false and listed in meta.not_assessed. Never treat them as findings.
- Per-check documentation pages live at https://dnsdeets.com/checks/<check-id-with-dashes>/

## Docs

- [Every check explained](https://dnsdeets.com/checks/)
- [API documentation](https://dnsdeets.com/api-docs/)
- [SPF/DKIM/DMARC setup guide](https://dnsdeets.com/guides/email-security/)