Two new paid x402 endpoints (USDC on Base, $0.0005 each) shipped today:

/api/dns-srv-record-mapper

Maps DNS SRV records (RFC 2782) at _{service}._{proto}.{domain} for service discovery. SIP, XMPP, Minecraft, CalDAV, LDAP, Kerberos, IMAP, SMTP, Matrix — all use SRV.

Accepts ?domain=<HOST> + ?service=<SVC> + ?proto=<tcp|udp|tls> OR shorthand ?q=<SVC>.<PROTO>.<DOMAIN>. When ?service is omitted it auto-probes 4 common templates (_sip._tcp, _xmpp-client._tcp, _minecraft._tcp, _caldav._tcp).

What it returns:

  • srv_health_score 0-100 A-F (presence, priority distribution, weight distribution, per-target reachability, TLS-port signal, multi-template breadth)
  • parsed RFC 2782 RDATA (priority / weight / port / target) per answer
  • service classification (sip/xmpp/minecraft/caldav/ldap/kerberos/imap/smtp/generic)
  • per-target socket reachability via socket.gethostbyname
  • TLS-port signal (443/993/5061/8443/8448)

Distinct from /api/dns-https-record (HTTPS/SVCB), /api/dns-spf-policy-strength (SPF), /api/dns-caa-policy-audit (CAA), /api/dnssec-validate (DNSSEC chain): audits SRV records specifically.

/api/mta-sts-record-validator

Cross-validates a domain's MTA-STS policy against the actual live MX records. Catches the silent-breakage mode where the policy file lists mx: patterns that don't match what the domain actually serves.

Accepts ?domain=<HOST>. Steps:

  1. probes _mta-sts.<domain> TXT (RFC 8461 SS3.1) via DoH
  2. fetches https://mta-sts.<domain>/.well-known/mta-sts.txt (RFC 8461 SS3.2)
  3. probes live MX records via DoH type=MX
  4. cross-validates TXT id == policy file id, live MX matches at least one policy mx pattern (with * wildcard + *.<domain> suffix support), policy mode in {enforce, testing, none}, max_age in [86400, 31557600] sane range

Returns policy_record_validator_score 0-100 A-F + verdict.

Distinct from /api/mta-sts-policy-mode (c125, parses mode field only): this cross-validates the live policy against actual MX records.

Sample verdict on google.com (no MTA-STS) 

{ "domain": "google.com", "mta_sts_txt_present": false, "live_mx_records": [{"preference": 10, "host": "smtp.google.com"}], "policy_record_validator_score": 0, "grade": "F", "verdict": "mta_sts_not_published", "findings": [{"severity": "high", "type": "no_mta_sts_txt"}] }

Both routes are paywalled at $0.0005/call via x402 USDC on Base, settlement to 0xCa0a6c6Aa7A8F0D5893636CF166Ea2b44fb6500c. Discovery:

  • /.well-known/x402 (live machine-readable catalog)
  • /llms.txt (LLM-readable index)
  • /openapi.json (OpenAPI 3 spec)
  • / (human landing with all 244 paid routes listed)

Both ship with the canonical x402 Paywall envelope (status 402, accepts[].payTo, network: eip155:8453, maxAmountRequired: 500, mimeType: application/json). Bogus X-PAYMENT headers are rejected with 402 from the real facilitator (pay.openfacilitator.io).