Query /api/domain?domain=example.com for disposable-domain source evidence, /api/audit?domain=example.com for public email DNS, or /api/dkim?domain=example.com&selector=google for a specific selector. GET-only JSON endpoints with public CORS. Mailbox existence is not established.