# Check my domain

Owner-initiated only. You prove you control a domain with one DNS TXT record;
we then tell you which public breaches touched addresses on it. We never look
up a person, never hold leaked passwords, and never contact anyone — you walk in.

## 1. Start verification (needs an agent key — mint one free at POST /api/accounts)

```bash
curl -X POST https://market.meshtool.ai/api/estate/verify -H 'Authorization: Bearer $MESH_KEY' \
  -H 'content-type: application/json' -d '{"domain":"example.com"}'
# → { record: "_mesh-verify.example.com", type: "TXT", value: "mesh-estate=<account>:<nonce>" }
```

## 2. Add that TXT record at your DNS host, then confirm

```bash
curl https://market.meshtool.ai/api/estate/verify/example.com -H 'Authorization: Bearer $MESH_KEY'
# → { verified: true, verified_at, expires_at }   (valid 90 days, re-checked on every breach call)
```

## 3. Run the breach check (MCP tool `mesh-breach-check` or REST)

```bash
curl -X POST https://market.meshtool.ai/api/call/mesh-breach-check -H 'Authorization: Bearer $MESH_KEY' \
  -H 'content-type: application/json' -d '{"input":{"domain":"example.com"}}'
```

Returns breach names, dates, how many of your addresses each touched, and the
addresses themselves (yours — you proved it). Never a password or hash.

## 4. Keep watching

`POST https://market.meshtool.ai/api/estate/watch {"domain":"example.com"}` — a daily re-check;
new breaches arrive as `estate.breach` events on your webhook subscription
(`POST /api/events/subscribe`).

## 5. Certificate watch (no key needed upstream — live today)

```bash
curl -X POST https://market.meshtool.ai/api/call/mesh-cert-watch -H 'Authorization: Bearer $MESH_KEY' \
  -H 'content-type: application/json' -d '{"input":{"domain":"example.com"}}'
# every certificate logged to Certificate Transparency for names under your domain (90 days), issuers, expiring soon
curl -X POST https://market.meshtool.ai/api/estate/cert-watch -H 'Authorization: Bearer $MESH_KEY' -d '{"domain":"example.com"}'
# daily; new certificates + never-seen issuers → estate.cert events
```

## 6. DNS posture (pure DNS reads — live today)

```bash
curl -X POST https://market.meshtool.ai/api/call/mesh-dns-posture -H 'Authorization: Bearer $MESH_KEY' \
  -H 'content-type: application/json' -d '{"input":{"domain":"example.com"}}'
# SPF, DMARC, DKIM, MTA-STS, TLS-RPT, CAA, DNSSEC — pass/warn/fail, the record to publish, a 0–100 score
curl -X POST https://market.meshtool.ai/api/estate/posture-watch -H 'Authorization: Bearer $MESH_KEY' -d '{"domain":"example.com"}'
# daily; any check whose status changes → estate.posture events
```

## 7. Exposure diff (what changed on a host since last time)

```bash
# a 24h authorization-to-test for the exact host (the audit lane's consent), then:
curl -X POST https://market.meshtool.ai/api/audit/consent -H 'Authorization: Bearer $MESH_KEY' -d '{"asset":"www.example.com","attest_ownership":true,"accept_terms":true}'
curl -X POST https://market.meshtool.ai/api/call/mesh-exposure-diff -H 'Authorization: Bearer $MESH_KEY' \
  -H 'content-type: application/json' -d '{"input":{"consent_id":"acon_…","asset":"www.example.com"}}'
# read-only external observation → snapshot → diff vs your previous one: added / resolved / unchanged / severity moves
```

No unattended watch for this lane by design: the authorization-to-test expires
in 24h, so every observation is one you asked for that day.

Pages: https://market.meshtool.ai/c/mesh-breach-check · https://market.meshtool.ai/c/mesh-cert-watch · https://market.meshtool.ai/c/mesh-dns-posture · https://market.meshtool.ai/c/mesh-exposure-diff · A call without a key answers HTTP 402 with the price.