# Lookproof > Checks and diagnostics for developers and AI agents: mail authentication (SPF, DMARC, DKIM, MX, MTA-STS, TLS-RPT, BIMI, mail providers), DNS (DNSSEC, CAA, reverse DNS), the web (TLS certificates, HTTP security headers, RDAP registration) and full domain and site health reports, with structured results and explained findings. ## Tools - [CAA record check](https://lookproof.dev/tools/dns/caa-check): See which certificate authorities may issue certificates for a domain: CAA records, inheritance from parent names, wildcard rules and iodef. - [DNS lookup](https://lookproof.dev/tools/dns/dns-lookup): Resolve A, AAAA, CNAME, MX, NS, TXT, SOA, CAA and SRV records for a name, with TTL and the public resolver that answered. - [DNSSEC check](https://lookproof.dev/tools/dns/dnssec-check): See whether a domain is DNSSEC-signed and validates: secure, insecure or bogus, with DS and DNSKEY details and outdated algorithms flagged. - [Domain health check](https://lookproof.dev/tools/domain/domain-health-check): A full domain health and email security check in one report: MX, SPF, DMARC, DKIM, MTA-STS, TLS-RPT, DNSSEC, reverse DNS, BIMI and CAA. - [RDAP domain lookup](https://lookproof.dev/tools/domain/rdap-lookup): Look up a domain's registration over RDAP: registrar, creation and expiry dates, EPP status codes, nameservers and whether the delegation is DNSSEC-signed. - [Security headers check](https://lookproof.dev/tools/http/security-headers): Follow a site's redirects from http:// and https:// and read its security headers: HSTS and preload readiness, CSP, frame protection and cookies. - [BIMI record check](https://lookproof.dev/tools/mail/bimi-check): Check a domain's BIMI record: syntax, HTTPS logo and certificate URLs, an SVG logo, a VMC, and whether DMARC is enforced as BIMI requires. - [DKIM record check](https://lookproof.dev/tools/mail/dkim-check): Check the DKIM public key record for a domain and selector: key type, RSA key size, revoked keys, testing mode and multiple records. - [DKIM selector finder](https://lookproof.dev/tools/mail/dkim-selector-finder): Find DKIM keys for a domain by trying a fixed list of common selectors from Google, Microsoft 365, SendGrid, Mailchimp and others, and check each key found. - [DMARC check](https://lookproof.dev/tools/mail/dmarc-check): Look up a domain's DMARC record under RFC 9989: policy, subdomain and non-existent-domain policy, testing mode, report addresses and the DNS tree walk. - [Mail configuration check](https://lookproof.dev/tools/mail/mail-check): One report on a domain's mail DNS: MX, SPF and DMARC together, plus DKIM for the selectors you supply. Bulk checks of up to 20 domains. - [Mail provider detection](https://lookproof.dev/tools/mail/mail-provider): Find out which mail provider hosts a domain's inbox, which gateway filters its mail and which services send for it, read from MX and SPF records. - [MTA-STS and TLS-RPT check](https://lookproof.dev/tools/mail/mta-sts-check): Check a domain's MTA-STS record and policy file, whether the policy covers every MX host, and the TLS-RPT record for TLS failure reports. - [MX lookup](https://lookproof.dev/tools/mail/mx-lookup): List a domain's mail servers sorted by preference, with resolved addresses, null MX detection and warnings for MX targets that do not resolve. - [Reverse DNS check for mail servers](https://lookproof.dev/tools/mail/reverse-dns-check): Check reverse DNS for a domain's mail servers: a PTR record for each MX address and whether that name resolves back to the same IP (FCrDNS). - [SPF check](https://lookproof.dev/tools/mail/spf-check): Check a domain's SPF record: DNS lookup count against the limit of ten, include and redirect chains, loops, multiple records and permissive all. - [Site health check](https://lookproof.dev/tools/site/site-health-check): A website security check in one report: the SSL/TLS certificate, HTTP to HTTPS redirects, HSTS and security headers, and when the domain expires. - [TLS certificate check](https://lookproof.dev/tools/tls/certificate-check): Check the TLS certificate a domain serves on port 443: expiry date, names, issuer and chain, key strength and whether browsers trust it. ## Guides - [Guides: email and DNS security explained](https://lookproof.dev/guides): Plain-language guides to SPF, DMARC, DKIM, MX, MTA-STS, DNSSEC, BIMI and CAA, written from the RFCs, with links to the matching checks and their findings. - [BIMI explained: the record, the logo and DMARC](https://lookproof.dev/guides/bimi): How BIMI publishes a brand logo for email: the TXT record at selector._bimi, the l= and a= tags, the DMARC requirements and what mail clients check. - [CAA records explained: which CAs may issue](https://lookproof.dev/guides/caa): How CAA records (RFC 8659) limit which certificate authorities may issue certificates for a domain: issue, issuewild, iodef, the critical flag and inheritance. - [DKIM explained: selectors, keys and rotation](https://lookproof.dev/guides/dkim): How DKIM signing and key records work under RFC 6376: selectors, the v, k, p and t tags, key sizes after RFC 8301, Ed25519, rotation and revocation. - [DMARC explained: policy, alignment and reports](https://lookproof.dev/guides/dmarc): How DMARC works under RFC 9989: SPF and DKIM alignment, the p, sp, np and t tags, the DNS tree walk, reports, and a safe path from none to reject. - [DNSSEC explained: DS, DNSKEY and validation](https://lookproof.dev/guides/dnssec): How DNSSEC signs DNS data under RFC 4033-4035: DS and DNSKEY records, the chain of trust, the four validation states and algorithm choice. - [MTA-STS and TLS-RPT explained: policy, mode and MX](https://lookproof.dev/guides/mta-sts): How MTA-STS (RFC 8461) makes senders require TLS for your mail and how TLS-RPT (RFC 8460) reports failures: the record, the policy file and its modes. - [MX records explained: priority and null MX](https://lookproof.dev/guides/mx): How MX records route email under RFC 5321: preference values, fallback to the address record, null MX from RFC 7505, valid targets and common mistakes. - [SPF explained: lookups, includes and all](https://lookproof.dev/guides/spf): How an SPF record works under RFC 7208: mechanisms, qualifiers, the ten-lookup and two-void-lookup limits, include versus redirect, and common mistakes. ## Docs - [Bulk checks](https://lookproof.dev/docs/bulk): Check up to 20 domains in one request: the JSON format, how results keep their order, how duplicates are counted and how the price is calculated. - [Errors and status codes](https://lookproof.dev/docs/errors): The HTTP status codes of the public Lookproof API, what each one means, whether a payment is taken, and the common error body with the request id. - [Freshness and caching](https://lookproof.dev/docs/freshness): How to read observed_at, fresh_until, cache_hit and resolver in the meta of a response, and why two calls can return different answers. - [Payments with x402](https://lookproof.dev/docs/payments): How paying per request with x402 works: a 402 Payment Required answer, the price in advance, payment in USDC on Base, then the same request again. - [Quickstart](https://lookproof.dev/docs/quickstart): Start using Lookproof checks: what a request looks like, what comes back, and how errors and freshness are reported in every response. ## API - [API reference: paid mail and DNS checks](https://lookproof.dev/docs/api): Reference for the Lookproof API: every endpoint with method, URL, price, input, example requests in curl, Python and JavaScript, responses and errors. - [CAA record check API](https://lookproof.dev/docs/api/dns-caa): GET /v1/dns/caa: Show which certificate authorities may issue for a domain, from its CAA records. Price, input fields, example requests, responses and errors. - [DNSSEC check API](https://lookproof.dev/docs/api/dns-dnssec): GET /v1/dns/dnssec: Report whether a domain is DNSSEC-signed and validates, from the resolvers' AD flag. Price, input fields, example requests, responses and… - [DNS lookup API](https://lookproof.dev/docs/api/dns-lookup): GET /v1/dns/lookup: Resolve selected record types with TTL and the resolver that answered. Price, input fields, example requests, responses and errors. - [Domain health check API](https://lookproof.dev/docs/api/domain-health): GET /v1/domain/health: One report on a domain's mail and DNS security: nine checks with coded findings. Price, input fields, example requests, responses and… - [RDAP domain lookup API](https://lookproof.dev/docs/api/domain-rdap): GET /v1/domain/rdap: Look up a domain's registrar, expiry date, EPP statuses and nameservers over RDAP. Price, input fields, example requests, responses and… - [Security headers check API](https://lookproof.dev/docs/api/http-security_headers): GET /v1/http/security-headers: Check HTTP to HTTPS redirects, HSTS, CSP and the other security headers of a site. Price, input fields, example requests… - [BIMI record check API](https://lookproof.dev/docs/api/mail-bimi): GET /v1/mail/bimi: Check a domain's BIMI record, its logo and certificate URLs, and DMARC enforcement. Price, input fields, example requests, responses and… - [Mail configuration check API](https://lookproof.dev/docs/api/mail-check): GET /v1/mail/check: One report covering MX, SPF, DMARC and DKIM for known selectors. Price, input fields, example requests, responses and errors. - [Bulk mail configuration check API](https://lookproof.dev/docs/api/mail-check-bulk): POST /v1/mail/check/bulk: Run the mail configuration check on up to 20 domains in one request. Price, input fields, example requests, responses and errors. - [Free retry of failed bulk items API](https://lookproof.dev/docs/api/mail-check-bulk-retry): POST /v1/mail/check/bulk/retry: Run the items of a paid bulk request that failed for technical reasons again, free of charge. Rules, input, example request… - [DKIM record check API](https://lookproof.dev/docs/api/mail-dkim): GET /v1/mail/dkim: Check the DKIM public key record for a given selector. Price, input fields, example requests, responses and errors. - [DKIM selector finder API](https://lookproof.dev/docs/api/mail-dkim_discover): GET /v1/mail/dkim-discover: Try 27 common DKIM selectors for a domain and check every key that is found. Price, input fields, example requests, responses and… - [DMARC check API](https://lookproof.dev/docs/api/mail-dmarc): GET /v1/mail/dmarc: Look up and explain a domain's DMARC policy and tags. Price, input fields, example requests, responses and errors. - [MTA-STS and TLS-RPT check API](https://lookproof.dev/docs/api/mail-mta_sts): GET /v1/mail/mta-sts: Check the MTA-STS record and policy file, MX coverage, and the TLS-RPT record. Price, input fields, example requests, responses and… - [MX lookup API](https://lookproof.dev/docs/api/mail-mx): GET /v1/mail/mx: List a domain's mail servers with priorities, including null MX. Price, input fields, example requests, responses and errors. - [Mail provider detection API](https://lookproof.dev/docs/api/mail-provider): GET /v1/mail/provider: Name the mailbox provider, gateways and sending services a domain uses, from MX and SPF. Price, input fields, example requests… - [Reverse DNS check for mail servers API](https://lookproof.dev/docs/api/mail-ptr): GET /v1/mail/ptr: Check PTR records and forward confirmation (FCrDNS) for a domain's MX addresses. Price, input fields, example requests, responses and errors. - [SPF check API](https://lookproof.dev/docs/api/mail-spf): GET /v1/mail/spf: Parse and evaluate a domain's SPF policy, including the DNS lookup budget. Price, input fields, example requests, responses and errors. - [Site health check API](https://lookproof.dev/docs/api/site-health): GET /v1/site/health: One report on a site's TLS certificate, HTTPS redirects, security headers and domain expiry. Price, input fields, example requests… - [TLS certificate check API](https://lookproof.dev/docs/api/tls-certificate): GET /v1/tls/certificate: Check the certificate a domain serves on port 443: expiry, name, chain and key. Price, input fields, example requests, responses and… - [OpenAPI 3.1 document](https://lookproof.dev/openapi.json): Machine-readable description of every endpoint, price and error. - [SKILL.md](https://lookproof.dev/SKILL.md): Instructions for AI agents: choosing a tool, paying with x402 and reading results. ## Reference - [Findings reference](https://lookproof.dev/findings): Every finding code Lookproof can report, grouped by topic, with what it means, why it matters and what to do about it. - [Pricing](https://lookproof.dev/pricing): Fixed prices per check and per-item prices for bulk requests, known before you pay. No account, no subscription; pay per request with x402 in USDC. - [Tool catalog: mail, DNS and web checks](https://lookproof.dev/tools): All Lookproof tools for email, DNS and websites: SPF, DMARC, DKIM, MTA-STS, DNSSEC, CAA, TLS certificates, security headers and domain health checks.