# OFAC Wallet Screen, DNS Lookup & Email Auth Check (x402)

> Three keyless pay-per-call tools for AI agents: OFAC SDN crypto-wallet screen, live DNS records lookup, and SPF/DMARC/DKIM email-auth check. $0.01 USDC on Base per call over x402. Also a remote MCP server at /mcp.

## OFAC SDN Wallet Screen

Screens a crypto wallet address (EVM, BTC, TRON, SOL, XMR and every other chain OFAC lists) against all Digital Currency Addresses on the US Treasury OFAC SDN list. Returns sanctioned true/false, verdict block/no_match, SDN entity name, sdnType, programs and the list publish date. Use when an agent is about to send funds to, pay, or accept funds from an unfamiliar wallet. $0.01 USDC on Base.

GET https://sdn-screen-x402.sdnscreen.workers.dev/v1/screen?address=0x098b716b8aaf21512996dc57eb0615e2383e2f96

- address (required): Wallet address. EVM 0x... (case-insensitive), BTC 1.../3.../bc1..., TRON T..., Solana base58, etc.

Example response:
```json
{
 "address": "0x098b716b8aaf21512996dc57eb0615e2383e2f96",
 "normalized": "0x098b716b8aaf21512996dc57eb0615e2383e2f96",
 "sanctioned": true,
 "verdict": "block",
 "matches": [
  {
   "sdnUid": 27307,
   "name": "LAZARUS GROUP",
   "sdnType": "Entity",
   "programs": [
    "DPRK3"
   ],
   "listedAsset": "ETH"
  }
 ],
 "list": "OFAC SDN (Digital Currency Address identifiers only)",
 "listPublishDate": "10/09/2026",
 "addressesOnList": 1050,
 "checkedAt": "2026-10-11T23:55:37.000Z",
 "disclaimer": "Exact-match lookup against addresses OFAC publishes on the SDN list. Not legal advice; a non-match does not mean an address is safe or unsanctioned (OFAC lists only some addresses; ownership/50% rule and other lists are not covered)."
}
```

## DNS Records Lookup

Resolves live DNS records for any domain or hostname via 1.1.1.1: A, AAAA, CNAME, MX, NS, TXT, SOA and CAA in one call (type=ALL), or a single type incl. SRV, PTR, DS, DNSKEY, HTTPS. Clean JSON with TTLs, NXDOMAIN flag and DNSSEC-authenticated bit. A URL or email address is reduced to its host. Use when an agent needs to verify a domain, find mail servers or nameservers, or read TXT/SPF records. $0.01 USDC on Base.

GET https://sdn-screen-x402.sdnscreen.workers.dev/v1/dns?name=example.com&type=ALL

- name (required): Domain or hostname, e.g. example.com. A full URL or email address is accepted and reduced to its host. Alias: domain.
- type: ALL (default: A, AAAA, CNAME, MX, NS, TXT, SOA, CAA) or one record type.

Example response:
```json
{
 "name": "example.com",
 "exists": true,
 "records": {
  "A": {
   "status": "NOERROR",
   "authenticated": true,
   "answers": [
    {
     "name": "example.com",
     "type": "A",
     "ttl": 34,
     "data": "172.66.147.243"
    },
    {
     "name": "example.com",
     "type": "A",
     "ttl": 34,
     "data": "104.20.23.154"
    }
   ]
  },
  "AAAA": {
   "status": "NOERROR",
   "authenticated": true,
   "answers": [
    {
     "name": "example.com",
     "type": "AAAA",
     "ttl": 12,
     "data": "2606:4700:10::ac42:93f3"
    }
   ]
  },
  "CNAME": {
   "status": "NOERROR",
   "authenticated": true,
   "answers": []
  },
  "MX": {
   "status": "NOERROR",
   "authenticated": true,
   "answers": [
    {
     "name": "example.com",
     "type": "MX",
     "ttl": 300,
     "data": "0 ."
    }
   ]
  },
  "NS": {
   "status": "NOERROR",
   "authenticated": true,
   "answers": [
    {
     "name": "example.com",
     "type": "NS",
     "ttl": 79225,
     "data": "hera.ns.cloudflare.com."
    },
    {
     "name": "example.com",
     "type": "NS",
     "ttl": 79225,
     "data": "elliott.ns.cloudflare.com."
    }
   ]
  },
  "TXT": {
   "status": "NOERROR",
   "authenticated": true,
   "answers": [
    {
     "name": "example.com",
     "type": "TXT",
     "ttl": 288,
     "data": "v=spf1 -all"
    }
   ]
  },
  "SOA": {
   "status": "NOERROR",
   "authenticated": true,
   "answers": [
    {
     "name": "example.com",
     "type": "SOA",
     "ttl": 1800,
     "data": "el
```

## Email Auth Check (SPF/DMARC/DKIM)

Checks a domain's email authentication: parses SPF (+all, ?all, multiple records, over 10 DNS lookups), DMARC (p, sp, pct, rua), DKIM keys (your selector or 15 common ones) and MX, then returns an A-F grade, 0-100 score and coded issues (spf_missing, dmarc_p_none, ...). Use when an agent must judge if a domain can be spoofed, debug deliverability, or vet a sender/vendor domain. $0.01 USDC on Base.

GET https://sdn-screen-x402.sdnscreen.workers.dev/v1/email-auth?domain=google.com&selector=20230601

- domain (required): Email domain, e.g. example.com. A URL or email address is reduced to its domain.
- selector: Optional DKIM selector to check authoritatively (in addition to the common list: google, selector1, selector2, default, k1, k2, s1, s2, dkim, mail, mandrill, pm, zoho, protonmail, fm1).

Example response:
```json
{
 "domain": "google.com",
 "grade": "A",
 "score": 97,
 "mx": {
  "records": [
   {
    "priority": 10,
    "host": "smtp.google.com"
   }
  ],
  "nullMx": false
 },
 "spf": {
  "present": true,
  "record": "v=spf1 include:_spf.google.com ~all",
  "allQualifier": "~all",
  "dnsLookups": 1
 },
 "dmarc": {
  "present": true,
  "record": "v=DMARC1; p=reject; rua=mailto:mailauth-reports@google.com",
  "policy": "reject",
  "subdomainPolicy": null,
  "pct": 100,
  "rua": "mailto:mailauth-reports@google.com"
 },
 "dkim": {
  "selectorsChecked": [
   "google",
   "selector1",
   "selector2",
   "default",
   "k1",
   "k2",
   "s1",
   "s2",
   "dkim",
   "mail",
   "mandrill",
   "pm",
   "zoho",
   "protonmail",
   "fm1"
  ],
  "found": []
 },
 "issues": [
  {
   "severity": "low",
   "code": "dkim_not_found",
   "message": "No DKIM key found at the checked selectors (pass selector= if you know it)."
  }
 ],
 "resolver": "Cloudflare 1.1.1.1 (DNS over HTTPS)",
 "checkedAt": "2026-10-11T23:55:37.407Z",
 "note": "Reads public DNS only; sends no mail. DKIM is checked at the given selector plus common selectors."
}
```

## Paying

Each call is $0.01 USDC on Base (eip155:8453), x402 v2 exact scheme. The first unpaid request returns HTTP 402 with a PAYMENT-REQUIRED header (base64 JSON). Sign it with any x402 client (e.g. @x402/fetch, AgentCash: npx agentcash add https://sdn-screen-x402.sdnscreen.workers.dev) and retry with PAYMENT-SIGNATURE. Payment settles only on success; 400 errors are never charged.

## MCP

Remote MCP server (streamable HTTP, JSON-RPC 2.0): POST https://sdn-screen-x402.sdnscreen.workers.dev/mcp. tools/list is free. tools/call returns an x402 PaymentRequired object (isError: true, structuredContent) until the call carries a signed payment in params._meta["x402/payment"] (@x402/mcp client).

OpenAPI: https://sdn-screen-x402.sdnscreen.workers.dev/openapi.json