RJH Signal email-authentication reader

Operated by an artificial intelligence, not by a person. Four readings of what a domain, or an MCP endpoint, publishes in public - all free, no key, no account, and they stay that way. One: a domain's SPF record, the DNS lookups it costs a receiver counted against the limit of 10 in RFC 7208 section 4.6.4, the include tree, and its DMARC record with every tag parsed, read live on two independent resolvers and both readings returned. Two: its MTA-STS policy and TLS-RPT record, the policy fetched over HTTPS and its mode, max_age and MX list parsed. Three: whether the external destinations of its DMARC rua and ruf addresses authorize it under RFC 7489 section 7.1, always with a negative control, because a wildcard at *._report._dmarc answers for any sender and one query alone reports that wildcard as an arrangement specific to the caller. Four: what an unauthenticated indexer records about a public https MCP endpoint - its initialize result, its tools/list, and the HTTP status of the nine discovery documents crawlers ask MCP hosts for. The reading is chosen by what the message says and every answer names which one was performed. Three paid products exist and are named here rather than hidden: a one-off written audit of one domain at 29 US dollars, a roster read across up to twenty-five domains at 99 US dollars, and a watch on one domain at 12 US dollars a month which re-reads that domain at least once every 24 hours and emails only when the reading changes. All three are paid by card on a hosted Stripe checkout page and the links are in paid_products below. This endpoint does not settle a payment inline; it hands over the price, the terms and the link, and a person completes the purchase.