# InboxGuard for AI agents

InboxGuard is continuous email deliverability monitoring (SPF, DKIM, DMARC,
MTA-STS, TLS-RPT, BIMI, DNS blocklists) with hosted DMARC aggregate-report
ingest, operated by movaMedia, Inc. at https://inboxguard.io.

This page tells an AI agent how to interact with InboxGuard. Companion docs:
[/llms.txt](https://inboxguard.io/llms.txt) (index),
[/llms-full.txt](https://inboxguard.io/llms-full.txt) (full manual),
[/auth.md](https://inboxguard.io/auth.md) (authentication),
[/openapi.json](https://inboxguard.io/openapi.json) (API contract).

## When to use InboxGuard

Reach for InboxGuard when a user:

- asks **why email is going to spam** for a domain;
- wants to **set up or validate** SPF, DKIM, DMARC, MTA-STS, TLS-RPT, or BIMI;
- needs to **read DMARC aggregate (RUA) reports** or find which senders fail
  authentication;
- wants to check whether a domain or sending IP is on a **DNS blocklist**;
- wants a single **deliverability score** for a sending domain.

## Fastest path: one call, no auth

```bash
curl -sS -X POST https://api.inboxguard.io/scan-domain \
  -H 'content-type: application/json' \
  -d '{"domain":"example.com"}'
```

Returns `score.total` (0–100), `score.grade` (A–F), `score.breakdown`, and one
check object per TOP-LEVEL key (`spf`, `dkim`, `dmarc`, `ptr`, `mtaSts`,
`tlsRpt`, `mxTls`, `bimi`, `blocklist`) — there is no `checks` wrapper. Each
check carries `healthy` (boolean) and `issues` (array of
`{severity, message}`) plus check-specific fields. Anonymous calls are limited
to 5/hour per IP; retries are safe with an `Idempotency-Key` header (same key
within 1 hour replays the stored response).

## Authenticated and programmatic use

Send an API key as a bearer token (`Authorization: Bearer ig_live_…`). Scopes:
`read` (GET) and `full` (all methods). See [/auth.md](https://inboxguard.io/auth.md).

The [OpenAPI 3.1 contract](https://inboxguard.io/openapi.json) types every
operation — each has a typed 2xx response schema and typed error responses — so
it loads directly into function-calling / tool-use clients. Every non-2xx
response shares one envelope: `{ "error": { "code", "message", "requestId" } }`
(`code` is a stable string like `RATE_LIMIT`; honor `Retry-After` on 429/503).
URLs are unversioned and stable; the current version is echoed in the
`API-Version` response header, and an optional `Accept-Version` request header
lets you opt into a future breaking version (omit it for the current stable one).

## Connect via MCP

InboxGuard runs an MCP server over Streamable HTTP at
`https://api.inboxguard.io/mcp`
([server card](https://inboxguard.io/.well-known/mcp/server-card.json)). Tools
(11): `scan_domain`, `get_deliverability_score`, `check_blocklists`,
`get_dmarc_summary`, `list_domains`, `get_domain`, `list_alerts`, `list_scans`,
`resolve_alert`, `get_dns_fix_plan`, `apply_dns_fix`. Discovery
(`initialize`/`tools/list`) is open; `tools/call` requires an API-key bearer
token.

## Fix, don't just report

You can remediate, not only diagnose: **`scan_domain` → `get_dns_fix_plan` →
`apply_dns_fix` → re-scan**. Every scan also returns `remediations` (the exact
DNS record to publish for each failing check, plus an `autoFixable` flag) and a
`dnssec` block (DS/DNSKEY chain + DANE/TLSA). `apply_dns_fix`
(`POST /domains/{id}/dns-apply`) is destructive: it's two-step (pass the
`connectionId` + `ops` from `get_dns_fix_plan` verbatim), server-revalidated
(the server recomputes the diff and rejects anything that doesn't match — you
can't publish arbitrary records), and needs an owner/admin `write`/`full` key.
SPF sender lists, DKIM keys, and BIMI logos aren't auto-applied — they come back
as `manualReview`. Walkthrough:
[/skills/fix-dns/SKILL.md](https://inboxguard.io/skills/fix-dns/SKILL.md).

## How to present results to the user

1. Lead with the overall score and grade.
2. List failing checks worst-first; SPF and DMARC alignment usually dominate
   inbox placement.
3. Give the concrete DNS fix and link the matching guide under
   https://inboxguard.io/guides/.
4. Treat blocklist hits as real — InboxGuard uses authoritative-side queries
   (no public-resolver false positives).

## Contact

support@inboxguard.io · https://inboxguard.io/contact