Email Header Audit

Live 402 challenge

Captured by the enrichment pass, not read just now. Prices can change — always read the 402 the endpoint answers with.

{
  "error": "Payment required",
  "accepts": [
    {
      "asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
      "extra": {
        "name": "USD Coin",
        "version": "2"
      },
      "payTo": "0x25e8245f07d5e4873987293dad666afbe56a9608",
      "amount": "200000",
      "scheme": "exact",
      "network": "eip155:8453",
      "maxTimeoutSeconds": 60
    }
  ],
  "resource": {
    "url": "https://api.zfinia.com/x402/v1/email-header-authentication-audit",
    "tags": [
      "email authentication",
      "headers",
      "dmarc",
      "forensics",
      "developer tooling"
    ],
    "mimeType": "application/json",
    "description": "Read the authentication headers a receiver added to one message. Headers are unfolded first, because a field continues on any line beginning with whitespace. Reports two From headers, where what is displayed and what is evaluated can differ, which is the shape of a spoof rather than a mistake; a lower Authentication-Results, which can have been written before the message arrived; a result from an untrusted server; and a DKIM or SPF domain that does not align with the From domain.",
    "serviceName": "Email Header Audit"
  },
  "extensions": {
    "bazaar": {
      "info": {
        "input": {
          "body": {
            "headers": "Received: from relay.vendor.test (relay.vendor.test [198.51.100.7])\n\tby mx.receiver.test with ESMTPS id abc123\n\tfor <ada@receiver.test>; Thu, 2 Oct 2026 12:00:00 +0000\nAuthentication-Results: relay.vendor.test;\n\tspf=softfail smtp.mailfrom=bounces.vendor.test;\n\tdkim=pass header.d=vendor.test;\n\tdmarc=fail\nAuthentication-Results: mx.receiver.test; spf=pass smtp.mailfrom=example.test; dkim=pass header.d=example.test\nFrom: Billing <billing@example.test>\nFrom: Billing <billing@example-test.test>\nSubject: Your invoice\n",
            "expected_from_domain": "example.test",
            "trusted_authserv_ids": [
              "mx.receiver.test"
            ]
          },
          "type": "http",
          "method": "POST",
          "bodyType": "json"
        },
        "output": {
          "type": "json",
          "example": {
            "limits": {
              "maxRecords": 2000,
              "maxFindings": 500,
              "maxHeaderBytes": 131072,
              "maxIncludeTree": 200,
              "spfLookupLimit": 10,
              "maxRecordLength": 4096,
              "spfVoidLookupLimit": 2
            },
            "passed": false,
            "methods": {
              "spf": [
                "softfail"
              ],
              "dkim": [
                "pass"
              ],
              "dmarc": [
                "fail"
              ]
            },
            "complete": true,
            "findings": [
              {
                "code": "SEVERAL_FROM_HEADERS",
                "detail": "There are 2 From headers. Which one is displayed and which one is evaluated can differ between a mail client and a filter, which is the shape of a spoof rather than a mistake."
              },
              {
                "code": "SEVERAL_AUTHENTICATION_RESULTS",
                "detail": "There are 2 Authentication-Results headers. Only the topmost one added by a trusted server may be relied on, because anything below it can have been added before the message arrived."
              },
              {
                "code": "AUTHSERV_ID_NOT_TRUSTED",
                "name": "relay.vendor.test",
                "detail": "The topmost Authentication-Results was added by relay.vendor.test, which is not in the trusted list. A result from an untrusted server says nothing, because anything upstream can write that header."
              }
            ],
            "request_id": "example-request",
            "service_id": "email_header_authentication_audit",
            "spf_domain": "bounces.vendor.test",
            "assumptions": [
              "Headers are unfolded first, because a field continues on any line beginning with whitespace and reading line by line would split an Authentication-Results header across several and parse none of them.",
              "Only the topmost Authentication-Results is relied on, and only when its authserv-id is in a list the caller supplies, because anything below it can have been written before the message arrived.",
              "Alignment is checked against the From domain, since a pass on a different domain is a pass DMARC does not accept however valid the signature is."
            ],
            "dkim_domain": "vendor.test",
            "from_domain": "example.test",
            "limitations": [
              "The headers supplied. No signature is verified and no DNS is resolved, so this reports what the receiving server recorded rather than independently confirming it.",
              "authenticated is true only when every recorded method passed, every domain aligned, and the result came from a server the caller named as trusted."
            ],
            "observed_at": "2026-10-02T00:00:00.000Z",
            "not_examined": [],
            "authenticated": false,
            "finding_count": 7,
            "service_version": "1.0.0",
            "findings_by_code": {
              "SEVERAL_FROM_HEADERS": 1,
              "SPF_DOMAIN_NOT_ALIGNED": 1,
              "AUTHSERV_ID_NOT_TRUSTED": 1,
              "DKIM_DOMAIN_NOT_ALIGNED": 1,
              "SEVERAL_AUTHENTICATION_RESULTS": 1,
              "AUTHENTICATION_METHOD_DID_NOT_PASS": 2
            },
            "from_header_count": 2,
            "received_hop_count": 1,
            "topmost_authserv_id": "relay.vendor.test",
            "authentication_results_count": 2
          }
        }
      },
      "schema": {
        "type": "object",
        "$schema": "https://json-schema.org/draft/2020-12/schema",
        "required": [
          "input"
        ],
        "properties": {
          "input": {
            "type": "object",
            "required": [
              "type",
              "method",
              "bodyType",
              "body"
            ],
            "properties": {
              "body": {
                "type": "object",
                "required": [
                  "headers"
                ],
                "properties": {
                  "headers": {
                    "type": "string",
                    "maxLength": 131072
                  },
                  "expected_from_domain": {
                    "type": "string",
                    "maxLength": 253
                  },
                  "trusted_authserv_ids": {
                    "type": "array",
                    "items": {
                      "type": "string",
                      "maxLength": 253
                    },
                    "maxItems": 50,
                    "minItems": 1
                  }
                },
                "additionalProperties": false
              },
              "type": {
                "type": "string",
                "const": "http"
              },
              "method": {
                "enum": [
                  "POST"
                ],
                "type": "string"
              },
              "bodyType": {
                "enum": [
                  "json",
                  "form-data",
                  "text"
                ],
                "type": "string"
              }
            },
            "additionalProperties": false
          },
          "output": {
            "type": "object",
            "required": [
              "type"
            ],
            "properties": {
              "type": {
                "type": "string"
              },
              "example": {
                "type": "object"
              }
            }
          }
        }
      }
    }
  },
  "x402Version": 2
}

Accepts

The payment requirements as published to the catalog. Read the live 402 before paying — a price here is a claim, not a quote.

[
  {
    "asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
    "extra": {
      "name": "USD Coin",
      "version": "2"
    },
    "payTo": "0x25e8245f07d5e4873987293dad666afbe56a9608",
    "amount": "200000",
    "scheme": "exact",
    "network": "eip155:8453",
    "maxTimeoutSeconds": 60
  }
]

Extensions

{
  "bazaar": {
    "info": {
      "input": {
        "body": {
          "headers": "Received: from relay.vendor.test (relay.vendor.test [198.51.100.7])\n\tby mx.receiver.test with ESMTPS id abc123\n\tfor <ada@receiver.test>; Thu, 2 Oct 2026 12:00:00 +0000\nAuthentication-Results: relay.vendor.test;\n\tspf=softfail smtp.mailfrom=bounces.vendor.test;\n\tdkim=pass header.d=vendor.test;\n\tdmarc=fail\nAuthentication-Results: mx.receiver.test; spf=pass smtp.mailfrom=example.test; dkim=pass header.d=example.test\nFrom: Billing <billing@example.test>\nFrom: Billing <billing@example-test.test>\nSubject: Your invoice\n",
          "expected_from_domain": "example.test",
          "trusted_authserv_ids": [
            "mx.receiver.test"
          ]
        },
        "type": "http",
        "method": "POST",
        "bodyType": "json"
      },
      "output": {
        "type": "json",
        "example": {
          "limits": {
            "maxRecords": 2000,
            "maxFindings": 500,
            "maxHeaderBytes": 131072,
            "maxIncludeTree": 200,
            "spfLookupLimit": 10,
            "maxRecordLength": 4096,
            "spfVoidLookupLimit": 2
          },
          "passed": false,
          "methods": {
            "spf": [
              "softfail"
            ],
            "dkim": [
              "pass"
            ],
            "dmarc": [
              "fail"
            ]
          },
          "complete": true,
          "findings": [
            {
              "code": "SEVERAL_FROM_HEADERS",
              "detail": "There are 2 From headers. Which one is displayed and which one is evaluated can differ between a mail client and a filter, which is the shape of a spoof rather than a mistake."
            },
            {
              "code": "SEVERAL_AUTHENTICATION_RESULTS",
              "detail": "There are 2 Authentication-Results headers. Only the topmost one added by a trusted server may be relied on, because anything below it can have been added before the message arrived."
            },
            {
              "code": "AUTHSERV_ID_NOT_TRUSTED",
              "name": "relay.vendor.test",
              "detail": "The topmost Authentication-Results was added by relay.vendor.test, which is not in the trusted list. A result from an untrusted server says nothing, because anything upstream can write that header."
            }
          ],
          "request_id": "example-request",
          "service_id": "email_header_authentication_audit",
          "spf_domain": "bounces.vendor.test",
          "assumptions": [
            "Headers are unfolded first, because a field continues on any line beginning with whitespace and reading line by line would split an Authentication-Results header across several and parse none of them.",
            "Only the topmost Authentication-Results is relied on, and only when its authserv-id is in a list the caller supplies, because anything below it can have been written before the message arrived.",
            "Alignment is checked against the From domain, since a pass on a different domain is a pass DMARC does not accept however valid the signature is."
          ],
          "dkim_domain": "vendor.test",
          "from_domain": "example.test",
          "limitations": [
            "The headers supplied. No signature is verified and no DNS is resolved, so this reports what the receiving server recorded rather than independently confirming it.",
            "authenticated is true only when every recorded method passed, every domain aligned, and the result came from a server the caller named as trusted."
          ],
          "observed_at": "2026-10-02T00:00:00.000Z",
          "not_examined": [],
          "authenticated": false,
          "finding_count": 7,
          "service_version": "1.0.0",
          "findings_by_code": {
            "SEVERAL_FROM_HEADERS": 1,
            "SPF_DOMAIN_NOT_ALIGNED": 1,
            "AUTHSERV_ID_NOT_TRUSTED": 1,
            "DKIM_DOMAIN_NOT_ALIGNED": 1,
            "SEVERAL_AUTHENTICATION_RESULTS": 1,
            "AUTHENTICATION_METHOD_DID_NOT_PASS": 2
          },
          "from_header_count": 2,
          "received_hop_count": 1,
          "topmost_authserv_id": "relay.vendor.test",
          "authentication_results_count": 2
        }
      }
    },
    "schema": {
      "type": "object",
      "$schema": "https://json-schema.org/draft/2020-12/schema",
      "required": [
        "input"
      ],
      "properties": {
        "input": {
          "type": "object",
          "required": [
            "type",
            "method",
            "bodyType",
            "body"
          ],
          "properties": {
            "body": {
              "type": "object",
              "required": [
                "headers"
              ],
              "properties": {
                "headers": {
                  "type": "string",
                  "maxLength": 131072
                },
                "expected_from_domain": {
                  "type": "string",
                  "maxLength": 253
                },
                "trusted_authserv_ids": {
                  "type": "array",
                  "items": {
                    "type": "string",
                    "maxLength": 253
                  },
                  "maxItems": 50,
                  "minItems": 1
                }
              },
              "additionalProperties": false
            },
            "type": {
              "type": "string",
              "const": "http"
            },
            "method": {
              "enum": [
                "POST"
              ],
              "type": "string"
            },
            "bodyType": {
              "enum": [
                "json",
                "form-data",
                "text"
              ],
              "type": "string"
            }
          },
          "additionalProperties": false
        },
        "output": {
          "type": "object",
          "required": [
            "type"
          ],
          "properties": {
            "type": {
              "type": "string"
            },
            "example": {
              "type": "object"
            }
          }
        }
      }
    }
  }
}

Provenance

Seen in the source catalog

2026-10-04 08:41Z

Last indexed by Roundhouse

2026-10-05 00:20Z

Last enriched (probe, favicon, geo)

2026-10-05 00:45Z

x402 version

2

Max timeout

60s

Liveness probe

HTTP 402