MTA-STS Policy Audit
Audit an MTA-STS policy against the MX hosts it is meant to authorise. Reports an MX host no pattern matches, which under enforce mode refuses every message to that host; testing or none mode, where nothing is enforced; a max_age under a day, where a receiver that cannot fetch the policy stops honouring it almost immediately; and a DNS record with no id, without which a cached policy is never refreshed.
MediaLiveeip155:8453Exactvia cdp
Mta-stsSmtp tlsEmail securityDomain trustDeveloper tooling
Settlements · 30d
218↓ 56%
No per-endpoint history for this service yet, so this is payments indexed to its PROVIDER's wallet over 30 days.
$25.30
Verified settled volume
255 settlements proven x402 by their on-chain EIP-3009 marker.
$0.160
Listed price
As published in the catalog. Always read the live 402 before paying.
1
Calls · 30d
Upstream's own call count for this endpoint, not ours.
1
Unique payers · 30d
Last called 2026-10-04 08:42Z
—
Upstream on-chain volume
Reported by the source catalog.
Paid to
0x25e8245f07d5e4873987293dad666afbe56a9608The wallet the 402 directs payment to. Its whole payment record — every payer, every chain — is on the merchant page.
Asset 0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913
Provider
The payTo wallet does not resolve to a registered ERC-8004 agent. That is not a verdict on the service — most of the catalog is unregistered.
Live 402 challenge
Captured by the enrichment pass, not read just now. Prices can change — always read the 402 the endpoint answers with.
{
"error": "Payment required",
"accepts": [
{
"asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
"extra": {
"name": "USD Coin",
"version": "2"
},
"payTo": "0x25e8245f07d5e4873987293dad666afbe56a9608",
"amount": "160000",
"scheme": "exact",
"network": "eip155:8453",
"maxTimeoutSeconds": 60
}
],
"resource": {
"url": "https://api.zfinia.com/x402/v1/mta-sts-policy-audit",
"tags": [
"mta-sts",
"smtp tls",
"email security",
"domain trust",
"developer tooling"
],
"mimeType": "application/json",
"description": "Audit an MTA-STS policy against the MX hosts it is meant to authorise. Reports an MX host no pattern matches, which under enforce mode refuses every message to that host; testing or none mode, where nothing is enforced; a max_age under a day, where a receiver that cannot fetch the policy stops honouring it almost immediately; and a DNS record with no id, without which a cached policy is never refreshed.",
"serviceName": "MTA-STS Policy Audit"
},
"extensions": {
"bazaar": {
"info": {
"input": {
"body": {
"domain": "example.test",
"policy": "version: STSv1\nmode: testing\nmx: *.vendor.test\nmax_age: 3600",
"mx_hosts": [
"mx1.vendor.test",
"mx2.vendor.test",
"backup-mx.other-vendor.test"
],
"dns_record": "v=STSv1;"
},
"type": "http",
"method": "POST",
"bodyType": "json"
},
"output": {
"type": "json",
"example": {
"mode": "testing",
"valid": false,
"domain": "example.test",
"limits": {
"maxRecords": 2000,
"maxFindings": 500,
"maxHeaderBytes": 131072,
"maxIncludeTree": 200,
"spfLookupLimit": 10,
"maxRecordLength": 4096,
"spfVoidLookupLimit": 2
},
"passed": false,
"complete": true,
"findings": [
{
"tag": "id",
"code": "DNS_ID_ABSENT",
"detail": "The DNS record declares no id. The id is how a receiver notices the policy changed, so without one a cached policy is never refreshed."
},
{
"code": "MODE_IS_TESTING",
"detail": "The policy is in testing mode, so a failure is reported and the message is delivered anyway. Nothing is enforced."
},
{
"code": "MAX_AGE_VERY_SHORT",
"detail": "The policy declares max_age of 3600 seconds, under a day. A short lifetime means a receiver that cannot fetch the policy stops honouring it almost immediately, which is the failure mode this protocol ..."
}
],
"request_id": "example-request",
"service_id": "mta_sts_policy_audit",
"assumptions": [
"A wildcard mx pattern matches exactly one label, as the specification defines it, so *.example.test matches mx1.example.test and not a.mx1.example.test.",
"A policy whose DNS record was not supplied is reported as not having been checked for discoverability, since a policy nobody can find is never applied.",
"Testing and none mode are reported with their consequence rather than as defects, because both are documented postures and both mean nothing is enforced."
],
"limitations": [
"The policy and records supplied. Nothing is fetched, no certificate is validated, and whether a sending host honours the policy is outside this.",
"valid is true only when the policy parsed, authorised every MX host supplied, and every check the caller asked for was performed."
],
"mx_patterns": [
"*.vendor.test"
],
"observed_at": "2026-10-02T00:00:00.000Z",
"not_examined": [],
"finding_count": 4,
"mx_host_count": 3,
"max_age_seconds": 3600,
"service_version": "1.0.0",
"findings_by_code": {
"DNS_ID_ABSENT": 1,
"MODE_IS_TESTING": 1,
"MAX_AGE_VERY_SHORT": 1,
"MX_HOST_NOT_AUTHORISED": 1
},
"mx_pattern_count": 1
}
}
},
"schema": {
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"required": [
"input"
],
"properties": {
"input": {
"type": "object",
"required": [
"type",
"method",
"bodyType",
"body"
],
"properties": {
"body": {
"type": "object",
"required": [
"domain",
"policy"
],
"properties": {
"domain": {
"type": "string",
"maxLength": 253
},
"policy": {
"type": "string",
"maxLength": 4096
},
"mx_hosts": {
"type": "array",
"items": {
"type": "string",
"maxLength": 253
},
"maxItems": 200,
"minItems": 1
},
"dns_record": {
"type": "string",
"maxLength": 4096
}
},
"additionalProperties": false
},
"type": {
"type": "string",
"const": "http"
},
"method": {
"enum": [
"POST"
],
"type": "string"
},
"bodyType": {
"enum": [
"json",
"form-data",
"text"
],
"type": "string"
}
},
"additionalProperties": false
},
"output": {
"type": "object",
"required": [
"type"
],
"properties": {
"type": {
"type": "string"
},
"example": {
"type": "object"
}
}
}
}
}
}
},
"x402Version": 2
}Accepts
The payment requirements as published to the catalog. Read the live 402 before paying — a price here is a claim, not a quote.
0.16USDC≈ $0.16 USD
on Base · exact scheme
Pay 0.16 USDC on Base to 0x25e8…a9608. The signed payment is good for 1 minute.
- Paid to
- 0x25e8…a9608
- USD Coin contract
- 0x8335…02913
- Payment window
- 1 minute
- As published
- 160000 smallest units
The catalog’s raw entry
[
{
"asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
"extra": {
"name": "USD Coin",
"version": "2"
},
"payTo": "0x25e8245f07d5e4873987293dad666afbe56a9608",
"amount": "160000",
"scheme": "exact",
"network": "eip155:8453",
"maxTimeoutSeconds": 60
}
]Extensions
{
"bazaar": {
"info": {
"input": {
"body": {
"domain": "example.test",
"policy": "version: STSv1\nmode: testing\nmx: *.vendor.test\nmax_age: 3600",
"mx_hosts": [
"mx1.vendor.test",
"mx2.vendor.test",
"backup-mx.other-vendor.test"
],
"dns_record": "v=STSv1;"
},
"type": "http",
"method": "POST",
"bodyType": "json"
},
"output": {
"type": "json",
"example": {
"mode": "testing",
"valid": false,
"domain": "example.test",
"limits": {
"maxRecords": 2000,
"maxFindings": 500,
"maxHeaderBytes": 131072,
"maxIncludeTree": 200,
"spfLookupLimit": 10,
"maxRecordLength": 4096,
"spfVoidLookupLimit": 2
},
"passed": false,
"complete": true,
"findings": [
{
"tag": "id",
"code": "DNS_ID_ABSENT",
"detail": "The DNS record declares no id. The id is how a receiver notices the policy changed, so without one a cached policy is never refreshed."
},
{
"code": "MODE_IS_TESTING",
"detail": "The policy is in testing mode, so a failure is reported and the message is delivered anyway. Nothing is enforced."
},
{
"code": "MAX_AGE_VERY_SHORT",
"detail": "The policy declares max_age of 3600 seconds, under a day. A short lifetime means a receiver that cannot fetch the policy stops honouring it almost immediately, which is the failure mode this protocol ..."
}
],
"request_id": "example-request",
"service_id": "mta_sts_policy_audit",
"assumptions": [
"A wildcard mx pattern matches exactly one label, as the specification defines it, so *.example.test matches mx1.example.test and not a.mx1.example.test.",
"A policy whose DNS record was not supplied is reported as not having been checked for discoverability, since a policy nobody can find is never applied.",
"Testing and none mode are reported with their consequence rather than as defects, because both are documented postures and both mean nothing is enforced."
],
"limitations": [
"The policy and records supplied. Nothing is fetched, no certificate is validated, and whether a sending host honours the policy is outside this.",
"valid is true only when the policy parsed, authorised every MX host supplied, and every check the caller asked for was performed."
],
"mx_patterns": [
"*.vendor.test"
],
"observed_at": "2026-10-02T00:00:00.000Z",
"not_examined": [],
"finding_count": 4,
"mx_host_count": 3,
"max_age_seconds": 3600,
"service_version": "1.0.0",
"findings_by_code": {
"DNS_ID_ABSENT": 1,
"MODE_IS_TESTING": 1,
"MAX_AGE_VERY_SHORT": 1,
"MX_HOST_NOT_AUTHORISED": 1
},
"mx_pattern_count": 1
}
}
},
"schema": {
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"required": [
"input"
],
"properties": {
"input": {
"type": "object",
"required": [
"type",
"method",
"bodyType",
"body"
],
"properties": {
"body": {
"type": "object",
"required": [
"domain",
"policy"
],
"properties": {
"domain": {
"type": "string",
"maxLength": 253
},
"policy": {
"type": "string",
"maxLength": 4096
},
"mx_hosts": {
"type": "array",
"items": {
"type": "string",
"maxLength": 253
},
"maxItems": 200,
"minItems": 1
},
"dns_record": {
"type": "string",
"maxLength": 4096
}
},
"additionalProperties": false
},
"type": {
"type": "string",
"const": "http"
},
"method": {
"enum": [
"POST"
],
"type": "string"
},
"bodyType": {
"enum": [
"json",
"form-data",
"text"
],
"type": "string"
}
},
"additionalProperties": false
},
"output": {
"type": "object",
"required": [
"type"
],
"properties": {
"type": {
"type": "string"
},
"example": {
"type": "object"
}
}
}
}
}
}
}Provenance
- Seen in the source catalog
- 2026-10-04 08:42Z
- Last indexed by Roundhouse
- 2026-10-05 00:20Z
- Last enriched (probe, favicon, geo)
- 2026-10-05 17:45Z
- x402 version
- 2
- Max timeout
- 60s
- Liveness probe
- HTTP 402
Hand this page to an agent
Copy the prompt and paste it into Claude, an MCP client or your own agent — it will vet this service and call it over the free read API. No key, no account.
GET api.roundhouseai.io/v0/endpoints
No per-endpoint history for this service yet, so this is payments indexed to its PROVIDER's wallet over 30 days. Verified volume counts only settlements with an on-chain EIP-3009 marker.
Show the promptHide the prompt
Using Roundhouse, look up the x402 service MTA-STS Policy Audit and tell me whether it is worth paying: what a call costs, whether the endpoint answered when last probed, and what its payment record actually shows. curl -s 'https://api.roundhouseai.io/v0/endpoints?q=MTA-STS%20Policy%20Audit' curl -s 'https://api.roundhouseai.io/v0/merchants/<the payTo wallet returned above>' Then call it: read the price from the live 402 at https://api.zfinia.com/x402/v1/mta-sts-policy-audit, never from a cached figure, and pay with an x402 client. The /v0 API needs an API key (`authorization: Bearer rh_live_…`) on everything except /v0/unified* and /v0/endpoints. Either pay over x402 (mint a personal key for $0.01 at GET https://api.roundhouseai.io/v0/test/x402), or ask me for an organization key, which I create at https://roundhouseai.io/dashboard/connections. If you have neither, ask before going further. If you do not have Roundhouse tools or skills installed, read https://roundhouseai.io/skill.md first — it is the whole procedure.