Lookproof
api.lookproof.dev · 47 paid endpoints · listed 2026-10-27
Check the TLS certificate a domain serves on port 443: whether it chains to a trusted root, matches the name (RFC 9525) and when it expires, with issuer, chain, key and signature algorithm, TLS version and coded findings for expired, expiring, untrusted, mismatched or weak certificates. Use when an agent must tell why HTTPS fails for a domain or when its certificate has to be renewed.
livelast check 5 days ago
100%valid x402 answers, 72 h
$0.943USDC received on Base, 7 days
9distinct payers, 7 days
58.8score (0-100)
Paid endpoints
| Method | Endpoint | Price | Networks |
|---|---|---|---|
| GET | api.lookproof.dev/v1/dns/idn Convert a domain name between Unicode and punycode (A-labels) and check it against IDNA2008 and UTS 46: disallowed characters, bidi, context and hyphen rules, l | $0.002 | Base |
| POST | api.lookproof.dev/v1/dns/zone-lint Check a pasted DNS zone file (RFC 1035 master format, up to 64 KiB) with $ORIGIN and $TTL: unreadable lines, SOA and NS at the apex, CNAME at the apex or beside | $0.002 | Base |
| POST | api.lookproof.dev/v1/http/cookie-parse Parse a pasted Set-Cookie header as RFC 6265bis does: Secure, HttpOnly, SameSite, Partitioned, __Host- and __Secure- prefix rules, Domain, Path, Expires and Max | $0.002 | Base |
| POST | api.lookproof.dev/v1/http/csp-parse Parse a pasted Content-Security-Policy value as CSP Level 3 does: directives and sources per policy, 'unsafe-inline' and 'unsafe-eval', wildcard and scheme-only | $0.002 | Base |
| POST | api.lookproof.dev/v1/http/hsts-parse Parse a pasted Strict-Transport-Security value as RFC 6797 does: whether browsers accept it, max-age, includeSubDomains, preload, and which hstspreload.org head | $0.002 | Base |
| GET | api.lookproof.dev/v1/ip/cidr Compute a CIDR block: network, first and last address, number of addresses, netmask and host mask, and whether the input had host bits set (192.0.2.5/24). IPv4 | $0.002 | Base |
| POST | api.lookproof.dev/v1/ip/contains Check one IPv4 or IPv6 address against up to 100 CIDR blocks and get, for each, whether it contains the address, plus the blocks that do; blocks of the other IP | $0.002 | Base |
| GET | api.lookproof.dev/v1/ip/info Classify an IPv4 or IPv6 address by IANA's special-purpose registries (private, loopback, link-local, shared, documentation, 6to4, Teredo, NAT64 and more, with | $0.002 | Base |
| GET | api.lookproof.dev/v1/ip/range-to-cidr Turn a start and end IPv4 or IPv6 address into the smallest list of CIDR blocks that covers exactly that range (at most 62 for IPv4, 254 for IPv6). Offline. Use | $0.002 | Base |
| GET | api.lookproof.dev/v1/ip/subnets Split an IPv4 or IPv6 CIDR block into subnets of a longer prefix, in order, at most 256 at a time; a larger split is refused before anything is computed. Offlin | $0.002 | Base |
| POST | api.lookproof.dev/v1/mail/bimi-parse Parse a pasted BIMI record: v=BIMI1, the l= logo and a= certificate tags, repeated or missing tags, HTTPS URLs, the .svg logo path and a missing mark certificat | $0.002 | Base |
| POST | api.lookproof.dev/v1/mail/dmarc-parse Parse a pasted DMARC record without DNS (RFC 9989): p, sp, np, psd, t, adkim, aspf, rua and ruf, historic and unknown tags, with the same coded findings as the | $0.002 | Base |
| POST | api.lookproof.dev/v1/mail/mta-sts-parse Parse a pasted MTA-STS policy file (RFC 8461) as a sending server would: version, mode, mx patterns and max_age, lines that do not parse, testing or none mode a | $0.002 | Base |
| POST | api.lookproof.dev/v1/mail/spf-parse Parse a pasted SPF record without DNS (RFC 7208): mechanisms with qualifiers and values, modifiers, syntax errors, the all policy and the number of terms that n | $0.002 | Base |
| POST | api.lookproof.dev/v1/mail/tlsrpt-parse Parse a pasted TLS-RPT record (RFC 8460): v=TLSRPTv1, exactly one rua tag and whether each report address is a mailto: or https: URI. Offline. Use when an agent | $0.002 | Base |
| POST | api.lookproof.dev/v1/tls/csr-decode Decode one pasted PEM certificate signing request (PKCS#10): subject, DNS and IP names, key type and size, signature algorithm and whether the signature matches | $0.002 | Base |
| POST | api.lookproof.dev/v1/tls/pem-decode Decode one pasted PEM X.509 certificate: subject, issuer, validity and days left, DNS and IP names, key type and size, signature algorithm, CA flag, key usages, | $0.002 | Base |
| GET | api.lookproof.dev/v1/dns/lookup Resolve chosen DNS record types (A, AAAA, CNAME, MX, NS, TXT, SOA, CAA, SRV) for a name through public resolvers, with TTL, observation time and the resolver th | $0.005 | Base |
| GET | api.lookproof.dev/v1/mail/provider Name the mail providers a domain uses from its MX hosts and SPF include tree: the mailbox provider behind the primary MX, inbound gateways and sending services, | $0.005 | Base |
| GET | api.lookproof.dev/v1/dns/caa Evaluate a domain's CAA records (RFC 8659), climbing to parent names up to the registrable domain when the name has none: allowed issuers for normal and wildcar | $0.01 | Base |
| GET | api.lookproof.dev/v1/dns/compare Ask Cloudflare and Google the same DNS question, each alone and uncached, and compare response codes and records; different codes (such as SERVFAIL from one) ar | $0.01 | Base |
| GET | api.lookproof.dev/v1/dns/dnssec Report a domain's DNSSEC status (secure, insecure, bogus or unknown) as validated by public resolvers, with DS and DNSKEY algorithms, deprecated algorithms, SHA | $0.01 | Base |
| GET | api.lookproof.dev/v1/dns/https-rr Read a name's HTTPS records (RFC 9460, SVCB): priority, target, AliasMode or ServiceMode, alpn (h3, h2), port, IPv4 and IPv6 hints and whether ECH is published, | $0.01 | Base |
| GET | api.lookproof.dev/v1/dns/ns Check a zone's name servers: the NS set, the IPv4 and IPv6 addresses of up to eight servers, a single server, servers that do not resolve, all addresses in one | $0.01 | Base |
| GET | api.lookproof.dev/v1/dns/ns-provider Find which DNS provider a domain's NS records point to (Cloudflare, Route 53, Azure DNS, Google Cloud DNS, GoDaddy, Namecheap, NS1, Hetzner, OVHcloud and more) | $0.01 | Base |
| GET | api.lookproof.dev/v1/dns/soa Check a zone's SOA record through public resolvers: primary server, contact name, serial (YYYYMMDDnn or counter), refresh, retry, expire and negative caching TT | $0.01 | Base |
| GET | api.lookproof.dev/v1/dns/ttl Show the TTL of A, AAAA, MX, NS, TXT, CAA and SOA records with its source: exact from a validated DNSSEC signature (RRSIG Original TTL) or the resolver's remain | $0.01 | Base |
| GET | api.lookproof.dev/v1/dns/txt-verification List the domain verification tokens in a domain's apex TXT records (google-site-verification, MS=, Atlassian, Facebook, Apple, Adobe, DocuSign, Stripe and more) | $0.01 | Base |
| GET | api.lookproof.dev/v1/dns/wildcard Find out whether a DNS zone has a wildcard (RFC 4592): A, AAAA, TXT and MX of a random, uncached name under the domain through public resolvers, with a warning | $0.01 | Base |
| GET | api.lookproof.dev/v1/domain/rdap Look up a domain's registration at its registry over RDAP (RFC 9083, servers from the IANA bootstrap file): registrar and IANA id, creation, change and expiry d | $0.01 | Base |
| GET | api.lookproof.dev/v1/http/security-headers Follow a site's redirect chains from http:// and https:// and read the security headers of the final HTTPS response: HSTS with preload readiness, Content-Securi | $0.01 | Base |
| GET | api.lookproof.dev/v1/mail/bimi Check a domain's BIMI record (<selector>._bimi, default selector, with fallback to the organisational domain): v=BIMI1 syntax, HTTPS logo and certificate URLs, | $0.01 | Base |
| GET | api.lookproof.dev/v1/mail/dkim Fetch and validate the DKIM public key record at selector._domainkey for a domain: key type, key size, revocation and syntax, with coded findings. Use when an a | $0.01 | Base |
| GET | api.lookproof.dev/v1/mail/dmarc Look up the DMARC record of a domain or its organisational domain and explain policy, subdomain policy, alignment and reporting addresses, with coded findings. | $0.01 | Base |
| GET | api.lookproof.dev/v1/mail/mx List a domain's mail servers in preference order and detect null MX (RFC 7505) and MX targets that do not resolve, with coded findings. Use when an agent must f | $0.01 | Base |
| GET | api.lookproof.dev/v1/mail/ptr Check reverse DNS for a domain's mail servers: up to five MX hosts, their IPv4 and IPv6 addresses, each PTR name and whether it resolves back to the same addres | $0.01 | Base |
| GET | api.lookproof.dev/v1/mail/spf Parse and evaluate a domain's SPF record: the include and redirect tree, qualifiers and the RFC 7208 limit of ten DNS lookups, with coded findings. Use when an | $0.01 | Base |
| GET | api.lookproof.dev/v1/mail/spf-flatten Unfold a domain's SPF policy (RFC 7208) into merged IPv4 and IPv6 blocks: include and redirect followed as a receiver counts them (10 lookups, 2 void lookups, P | $0.01 | Base |
| GET | api.lookproof.dev/v1/mail/spoofable Read how far a domain's DMARC policy (RFC 9989) asks receivers to act on mail that fails it: none, partial or full, with the effective policy after test mode (t | $0.01 | Base |
| GET | api.lookproof.dev/v1/mail/tlsrpt Check a domain's TLS-RPT record (RFC 8460) at _smtp._tls: one v=TLSRPTv1 record with exactly one rua tag of mailto: or https: report addresses. Use when an agen | $0.01 | Base |
| GET | api.lookproof.dev/v1/tls/certificate Check the TLS certificate a domain serves on port 443: whether it chains to a trusted root, matches the name (RFC 9525) and when it expires, with issuer, chain, | $0.01 | Base |
| GET | api.lookproof.dev/v1/mail/dkim-discover Try 27 common DKIM selectors (Google, Microsoft 365, Mailchimp, SendGrid, Mailgun, Zoho, Proton, Fastmail, Mailjet, Amazon SES and generic names) for a domain a | $0.02 | Base |
| GET | api.lookproof.dev/v1/mail/mta-sts Check a domain's MTA-STS setup (RFC 8461): the _mta-sts record, the HTTPS policy file with certificate check and no redirects, mode, max_age and whether every M | $0.02 | Base |
| GET | api.lookproof.dev/v1/site/health One report on a website's security basics: the TLS certificate on port 443 (trust, name, expiry, key), the redirect chains from http:// and https:// with HSTS, | $0.025 | Base |
| GET | api.lookproof.dev/v1/mail/check One report on a domain's mail setup: MX, SPF and DMARC, plus DKIM for the selectors you give, with coded findings and an overall status. Use when an agent needs | $0.03 | Base |
| POST | api.lookproof.dev/v1/mail/check/bulk Run the mail configuration check (MX, SPF, DMARC) on up to 20 domains in one request. Results keep the input order, and items that fail for a technical reason c | $0.048 | Base |
| GET | api.lookproof.dev/v1/domain/health One report on a domain's mail and DNS security: MX, SPF, DMARC, common DKIM selectors, MTA-STS with TLS-RPT, DNSSEC, reverse DNS of the mail servers, BIMI and C | $0.08 | Base |
Latest checks
| When | Endpoint | HTTP | ms | Result |
|---|---|---|---|---|
| 5 days ago | api.lookproof.dev/v1/dns/caa | 402 | 334 | valid x402 v2 terms |
Income on Base (7 days)
| Day | Transfers | USDC | |
|---|---|---|---|
| 2026-10-31 | 1 | $0.002 | |
| 2026-10-30 | 4 | $0.008 | |
| 2026-10-29 | 1 | $0.002 | |
| 2026-10-28 | 21 | $0.13 | |
| 2026-10-27 | 29 | $0.376 | |
| 2026-10-26 | 5 | $0.045 | |
| 2026-10-25 | 24 | $0.38 |
Is this your API?
Add the live badge to your docs: 
Claim it for free with
<a href="https://logicnodes.io/observatory/p/api.lookproof.dev"><img src="https://logicnodes.io/observatory/badge/api.lookproof.dev.svg" alt="x402 status"></a>
Claim it for free with
x402_provider_claim (sign with your payout address), and get an alert within minutes when it stops answering with x402_monitor_create ($5 for 30 days). Both work over MCP (https://logicnodes.io/mcp/v2) or POST https://logicnodes.io/v1/tools/<tool>.Income is all USDC received by the provider's payout address on Base, whatever the source. Score: 0-100: 50 x share of checks in the last 72 h that returned valid x402 payment terms + 30 x min(1, log10(1 + USDC received in 7 days) / 4) + 20 x min(1, log10(1 + distinct payers in 7 days) / 3). A provider never checked scores on income only; income is all USDC received by its payout address on Base, whatever the source. JSON: /v1/observatory/providers/api.lookproof.dev