<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# API Reference — Performing Email Authentication Testing

## DNS Record Queries

```bash
# SPF
dig TXT example.com +short | grep "v=spf1"

# DKIM
dig TXT selector1._domainkey.example.com +short

# DMARC
dig TXT _dmarc.example.com +short

# ARC — check forwarded message headers
grep -E "^ARC-(Seal|Message-Signature|Authentication-Results):" msg.eml
```

## swaks — SMTP Testing

```bash
# Test legitimate sender (should pass SPF)
swaks --to test@example.com --from legit@example.com --server mx.example.com

# Test spoofed sender (should fail SPF)
swaks --to test@example.com --from ceo@example.com --server external.com
```

## Agent Script

```bash
# Check SPF record
node agent.js check-spf --domain example.com

# Check DKIM record
node agent.js check-dkim --domain example.com --selector selector1

# Check DMARC record
node agent.js check-dmarc --domain example.com
```
