Paid DKIM and BIMI audit APIs for AI agents (shipped today on x402 micropayments)

#python #ai #email #security

I shipped two new sub-cent endpoints for AI agents today — both around email authentication and brand verification, both callable for under a tenth of a cent per call via x402 micropayments.

What's live (as of 2026-09-13)

GET /api/dkim?domain= ($0.0005 USDC per call)
DKIM (RFC 6376) selector record lookup + RSA-key verifier. Sweeps the default selector set (google, s1, s2, k1, k2, default, selector1, selector2, mail, mandrill, sendgrid, postmark, mailgun, cm, dkim) OR you can pass ?selector=<name> to check one specifically. Parses v=DKIM1 / k=rsa / p= / n= / t= / s= / h= fields and returns per-selector findings:

key_missing (p= tag empty — selector cannot verify signatures)
weak_key (decoded p= < 128 bytes — below modern RSA-2048 equivalent)
hash_includes_sha1 (RFC 8301 forbids SHA-1)

GET /api/bimi?domain= ($0.0005 USDC per call)
BIMI (Brand Indicators for Message Identification) record + VMC SVG validator. Queries default._bimi.<domain> TXT via Cloudflare DNS-over-HTTPS, parses v=BIMI1; l=<logo URL>; a=<VMC evidence URL>. Then HEAD-fetches the SVG and validates:

content-type is image/svg+xml
the SVG contains a bimi-square, bimi-circle, or bimi-full shape marker per PSLA 1.0
the a= VMC chain URL is reachable (if present)

Why this exists

Post-Feb-2024, Gmail and Yahoo require SPF + DKIM + DMARC alignment for bulk senders (>5000 messages/day). Microsoft added DMARC requirements in May 2025. The hard part isn't setting them up — it's checking whether they're set up correctly for a third-party domain without having to spin up a Linux box, install opendkim-tools, parse BIND logs, etc.

So if you're an AI agent doing outbound email audit, brand-protection work, M&A due diligence, vendor risk reviews, or just compliance-check-as-a-service, you can now do:

from x402 import x402ClientSync
from x402.mechanisms.evm.exact import ExactEvmScheme

client = x402ClientSync()
client.register("eip155:8453", ExactEvmScheme(signer=my_signer))
audit = client.get("https://epson-rpm-america-satisfy.trycloudflare.com/api/dkim?domain=cisco.com&selector=selector1")
mail = client.get("https://epson-rpm-america-satisfy.trycloudflare.com/api/bimi?domain=cisco.com")

That's $0.001 total — less than a mill — for a full DKIM + BIMI audit of one domain. Compare to the ~2 hours of bash + Python it would take to do the same thing manually with dig TXT and curl -I.

What the output looks like

For ?domain=cisco.com on DKIM (selector1):

{
  "domain": "cisco.com",
  "selectors_probed": ["google", "s1", "s2", "k1", "k2", ...],
  "selectors_found": ["selector1"],
  "results": [{
    "selector": "selector1",
    "found": true,
    "version": "DKIM1",
    "key_type": "rsa",
    "key_size_bytes": 256,
    "hash_algos": ["sha256"],
    "findings": []
  }],
  "any_dkim_verified": true
}

For ?domain=cisco.com on BIMI:

{
  "domain": "cisco.com",
  "found": true,
  "bimi_record": "v=BIMI1; l=https://vmc.digicert.com/21ad3861-6e82-45a7-b5c2-96f1d808a3fc.svg; a=https://vmc.digicert.com/21ad3861-6e82-45a7-b5c2-96f1d808a3fc.pem",
  "logo_url": "https://vmc.digicert.com/21ad3861-6e82-45a7-b5c2-96f1d808a3fc.svg",
  "svg_present": true,
  "svg_content_type": "image/svg+xml",
  "svg_bimi_shape": "circle",
  "evidence_url": "https://vmc.digicert.com/21ad3861-6e82-45a7-b5c2-96f1d808a3fc.pem",
  "findings": ["svg_shape_ok (PSLA-compliant bimi-* shape marker present)"]
}

For ?domain=example.com (no DKIM, no BIMI) you get:

{
  "domain": "example.com",
  "found": false,
  "findings": ["no_bimi_record (no default._bimi TXT — domain has no brand indicator)"]
}

What this completes

With these two new routes, the email-audit stack now covers:

Layer	Route	Cost
SPF	`/api/dns?domain=<host>` (parse TXT for `v=spf1`)	$0.001
DKIM	`/api/dkim?domain=<host>` (NEW)	$0.0005
DMARC	`/api/dmarc?domain=<host>`	$0.0005
MTA-STS	`/api/mta-sts?domain=<host>`	$0.0005
BIMI	`/api/bimi?domain=<host>` (NEW)	$0.0005
TLS	`/api/ssl?domain=<host>`	$0.0005

That's a full post-2024 Gmail/Yahoo bulk-sender + brand-stack audit in 6 calls for ~$0.0035 USDC. Or 6 paid API calls for the price of one coffee.

Discovery

Live: https://epson-rpm-america-satisfy.trycloudflare.com/api/dkim and /api/bimi
Discovery doc (45 paid routes total): https://epson-rpm-america-satisfy.trycloudflare.com/.well-known/x402
OpenAPI spec: https://epson-rpm-america-satisfy.trycloudflare.com/openapi.json
Indexed on 402index.io

If you're building an agent that does outbound email audit or vendor security reviews, these should be on your tool list.

DEV Community