Fetch a company's homepage (3-second deadline per attempt, at most 6 s including the insecure-TLS retry and the http:// fallback; transparent bot User-Agent) and fingerprint its technology stack against 455 signatures: CMS / site builder, e-commerce platform, JavaScript framework, CDN & hosting, WAF, analytics, tag manager, marketing automation, CRM, live chat, payments, advertising pixels, consent management and more. Also inspects the TLS certificate (validity, expiry, issuer, hostname match) and grades HTTP security headers (HSTS, CSP, X-Frame-Options, cookies) into a 0-100 security score. Handles redirects, WAF challenge pages (reported as blocked=true), timeouts and unreachable hosts gracefully. Use it to qualify prospects ("is this a Shopify store using Klaviyo?"), research competitors, or pre-screen leads. Cost: 1 credit.

Run live DNS checks on a domain's email setup: MX records with provider identification (Google Workspace, Microsoft 365, Proofpoint...), SPF parsing with recursive include resolution and the 10-lookup limit, DKIM key discovery across 86 common selectors (key type and length), DMARC policy and reporting configuration (with organizational-domain fallback), MTA-STS, TLS-RPT, BIMI and disposable-domain detection. Returns a severity-sorted list of deliverability and spoofing risks with remediation advice, the detected sending platforms, and a 0-100 deliverability score with a per-component breakdown. Use it before outbound campaigns, to validate lead domains, or to audit a prospect's email security. Cost: 1 credit.

Run inspect_tech_stack and verify_email_infrastructure concurrently and aggregate them into a single 0-100 health score (email deliverability 40%, security posture 35%, infrastructure maturity 25%) with a letter grade, merged severity-sorted findings, and human-readable highlights suitable for a research brief or CRM enrichment. Includes the full output of both underlying tools. If one inspection fails the other still completes and the error is reported inline. Cost: 2 credits.

Return everything this server has recorded about a domain from earlier scans, without running a new one: current and past technologies with first-seen and last-seen dates, the latest email posture (MX provider, SPF and DMARC policy, DKIM selectors, high risks), and a dated change log (technologies added or removed, DMARC weakened, DKIM key lost, MX provider changed, score drops). Use it to spot a prospect that just adopted or dropped a tool, or to see how a domain's email security has moved over time. known=false means the domain has never been scanned here; run inspect_tech_stack or verify_email_infrastructure first. Cost: 1 credit.

Queue a lead list for background checking: email (deliverability), tech (technology stack) or audit (both) for up to 1000 domains. Returns a job id immediately; poll get_bulk_check for progress and paged results. Every scan is also recorded for domain_history. Charged when the job is accepted, per accepted domain, at the matching single-domain tool's price (email 1, tech 1, audit 2 credits, or one daily-quota unit per domain on plan keys); items that fail for retryable reasons or are cancelled are refunded when the job finishes; the charge shows in job.creditsCharged or job.quotaUnitsCharged, not in billing.creditsCharged. Invalid and duplicate inputs are never charged, but a list with more invalid or duplicate entries than max(100, accepted domains) is refused with INVALID_ARGUMENT.

Status, counts and one page of per-domain results for a bulk check started by this caller. Results are compact summaries (score, grade, providers, policies, technologies). For email checks spfPolicy and dmarcPolicy can also be missing (no record) or unknown (the lookup failed, an SPF redirect= target's lookup failed, or a subdomain's own _dmarc lookup failed), dmarcPolicy invalid (a record without a valid policy), and mxProvider unknown (the MX lookup failed) or 'null MX (no mail)'. Free.

This caller's most recent bulk checks, newest first, with status and counts. Free.

Cancel the pending items of a bulk check; items already running finish normally. Cancelled items are refunded when the job finishes. Free.

Re-check a domain every 24 hour(s) and raise an alert when its email posture (DMARC or SPF weakened, DKIM key lost, MX provider changed, score drop...) or technology stack (tool added or removed) changes. Alerts are read with get_alerts and can also be pushed to a signed webhook. Watching a domain again updates its checks and webhook. Plan keys include a number of watched domains; prepaid callers pay 1 credit(s) per scheduled check, and a watch pauses (with an alert) when the balance runs out and resumes after a top-up. Watching itself is free.

Stop watching a domain (by watchId or domain); its alerts are deleted with it. Free.

This caller's watched domains with their checks, last and next check times and pause state. Free.

Alerts raised for this caller's watched domains, oldest first. Each names the domain, what changed (e.g. dmarc_policy reject -> none, tech_added Klaviyo, dkim_lost), the old and new values and a severity. By default returns unread alerts and marks them read. Free.