{
"domain": "github.com",
"cached": false,
"checkedAt": "2026-10-21T14:09:42.267Z",
"grade": "D",
"score": 68,
"summary": {
"errors": 0,
"warnings": 3,
"infos": 2
},
"spf": {
"record": "v=spf1 ip4:192.30.252.0/22 include:spf.protection.outlook.com include:_netblocks.google.com include:_netblocks2.google.com include:mail.zendesk.com include:_spf.salesforce.com include:servers.mcsv.net include:mktomail.com include:sendgrid.net ip4:62.253.227.114 ip4:166.78.69.169 ip4:166.78.69.170 ip4:166.78.71.131 ~all",
"qualifierAll": "~",
"mechanisms": 14,
"dnsLookups": 10,
"lookupLimit": 10,
"includes": [
"spf.protection.outlook.com",
"_netblocks.google.com",
"_netblocks2.google.com",
"mail.zendesk.com",
"_spf.salesforce.com",
"servers.mcsv.net",
"mktomail.com",
"sendgrid.net"
],
"redirect": null,
"resolvedTree": [
{
"domain": "spf.protection.outlook.com",
"via": "include",
"depth": 1
},
{
"domain": "_netblocks.google.com",
"via": "include",
"depth": 1
},
{
"domain": "_netblocks2.google.com",
"via": "include",
"depth": 1
},
{
"domain": "mail.zendesk.com",
"via": "include",
"depth": 1
},
{
"domain": "_spf.salesforce.com",
"via": "include",
"depth": 1
},
{
"domain": "servers.mcsv.net",
"via": "include",
"depth": 1
},
{
"domain": "mktomail.com",
"via": "include",
"depth": 1
},
{
"domain": "sendgrid.net",
"via": "include",
"depth": 1
},
{
"domain": "ab.sendgrid.net",
"via": "include",
"depth": 2
}
]
},
"dmarc": {
"record": "v=DMARC1; p=quarantine; sp=reject; pct=100; rua=mailto:[email protected]; ruf=mailto:[email protected]; fo=1",
"policy": "quarantine",
"subdomainPolicy": "reject",
"effectivePolicyForQueriedDomain": "quarantine",
"pct": 100,
"rua": [
"mailto:[email protected]"
],
"alignment": {
"dkim": "r",
"spf": "r"
},
"inheritedFrom": null
},
"dkim": {
"selectorsChecked": [
"google",
"selector1",
"selector2",
"k1",
"k2",
"default",
"s1",
"s2",
"mail",
"dkim"
],
"selectorsProvided": false,
"keys": [
{
"selector": "google",
"found": true,
"record": "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAj6T5sl/RwdSqGoYWaWaFbS2UAeyPrEmd0gogocmRfS441qwR8/0KB81Hw89P0l4YiFRrXYk7NVIGfyCRHAYYZUzCkGeOysI2EjgzLFhd/NEsbRzOEc/kWkK/RO6JFq/5lOn6M9AZw/ap9tds4JG9ApgNNdSpPxp9DmvpsOSgNMVflRxQFrk3kdS4RNAPKu/OPoA7dlR/A/pECryjRoYgENtDXzdnK70HgCekems6UDzxDj61cjyoKoXtEMF/QsaHEQ1Gjfv014rDJBsubk/kT5VqHkWHa/ia68Z5r228Ety/wFfQNjXTx/J7KGZ9GkZlKED659eiJcLnWcKDSi…",
"keyType": "rsa",
"keyBits": 2048,
"revoked": false,
"testing": false
},
{
"selector": "selector1",
"found": true,
"record": "v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCxZC/z2cK+2s1f/ktzSDSeFzkfIHrjwtGFsfKMAYvKaXjPVNzKykpbXBkX5nB7dVUTFttda7aROr2iSrIseQ27Ui+4rUZVzgFanE8RaXhYM9n5wPKNv8GtLJk7JgcsYZ7ErgID4uW2sEYyV/dnRYw6rDzOaeRKkKELTUfJI5ebLQIDAQAB;",
"keyType": "rsa",
"keyBits": 1024,
"revoked": false,
"testing": false
},
{
"selector": "k1",
"found": true,
"record": "k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDbNrX2cY/GUKIFx2G/1I00ftdAj713WP9AQ1xir85i89sA2guU0ta4UX1Xzm06XIU6iBP41VwmPwBGRNofhBVR+e6WHUoNyIR4Bn84LVcfZE20rmDeXQblIupNWBqLXM1Q+VieI/eZu/7k9/vOkLSaQQdml4Cv8lb3PcnluMVIhQIDAQAB;",
"keyType": "rsa",
"keyBits": 1024,
"revoked": false,
"testing": false
},
{
"selector": "k2",
"found": true,
"record": "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAv2aC2KjGKLOwTweBY5A9RpjsxaBXR9r7OAU6U8/zn92ivImI75naUujWbItRI/QmL1jy5PWGqLwoUA0b90ObWaLDc+i9MtTNmGeWO009hr20fIxhGg6XBT2kjZ1DTThopSe1nAndsupmcBwlQ5Q6LJ+ZAxLcujnPIxM0ZBLmgpkv8u6RfY4eFP8OLvdAW3oSuB0DyLDigQX4Sj8wBO4YIdQH6AAmBeOsidsKAFNFUCpc3vCxtBDR12U+cBg724l3sBkMQ8evnz6idnqxq9QAVYh8k4kJ+RP+6cqTdy7LjIm8xY/bQNpQIpGUAuDo2DjLcCDun9DAI4Q/3z+Q0o…",
"keyType": "rsa",
"keyBits": 2048,
"revoked": false,
"testing": false
},
{
"selector": "s1",
"found": true,
"record": "k=rsa; t=s; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAyn3fMCVpb7ryIRKOGXhXVGYmsWUitNlSckqGHOwNFZgFadplOrD+Qzf1XQkP7MH/VB/97DsAAJGtEXW1Uq71Hjnfr/DuBN/YfjF/gU70qEFb7q1sdIiNtjFL2TkOpoW+X/bhhPNheW/fYwyFb6ZHFM6LTgXyuimWRHTOUP3VjZzhNVda79nt+2WZYbS4l8HdMgWpTNHjpVw5PtXESA9KBg/evSRk5fIaXIX5eRXW3baoV9yVzD8O29/IL/DiSk+yNvaO0EHL5c4yGuZJhGzvpiznb2IDVdemJK4Dqzdy5FTN/SGYZhAEr7MguG3Z314hMS2scgMsOMgB64uj/6+6Uw…",
"keyType": "rsa",
"keyBits": 2048,
"revoked": false,
"testing": false
},
{
"selector": "s2",
"found": true,
"record": "k=rsa; t=s; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAnNt2/H6bKs99C6DAaokPp62KN9mKaD20D1PBakkObejkJvzM6Un/fKHPeI2/qXdvFFBPQE3mxMNoe+hwBVDgMgCuZEn8J6gZYI4amITure9/ny6+GaNVRoH2m6xAtWwKINkKxMayGiehkWlRVb7D23F0U8y+VDHKQFz1bnXA5jDpcDiMXy8i2lV5vEys+qt+1WGhDKCAwamT8c3xkZz8aXMJaXYCiN2HMgHDU81+mVCk4+u6mY+a98APVfFhsQ0KCq/mVZXaXTV06QrG9M5PtBHUFW7VtwXKp+AFrAut0KW1NnwaA5IGA5sc+n9dma7bSqdfGS+ixdSmJ69NwmYSHw…",
"keyType": "rsa",
"keyBits": 2048,
"revoked": false,
"testing": false
}
]
},
"mx": {
"records": [
{
"priority": 0,
"host": "github-com.mail.protection.outlook.com"
}
],
"nullMx": false,
"hasMail": true
},
"mtaSts": null,
"tlsRpt": null,
"bimi": null,
"issues": [
{
"severity": "warning",
"code": "spf_lookups_near_limit",
"message": "The SPF evaluation uses 10 of the 10 allowed DNS-querying terms; adding another include may break SPF."
},
{
"severity": "warning",
"code": "dkim_key_1024",
"message": "selector1._domainkey: the RSA key is 1024 bits; 2048 bits is the current recommendation."
},
{
"severity": "warning",
"code": "dkim_key_1024",
"message": "k1._domainkey: the RSA key is 1024 bits; 2048 bits is the current recommendation."
},
{
"severity": "info",
"code": "mta_sts_missing",
"message": "No MTA-STS record (_mta-sts TXT). MTA-STS lets receiving domains require TLS for inbound mail; it matters mainly for domains that receive mail."
},
{
"severity": "info",
"code": "tls_rpt_missing",
"message": "No TLS-RPT record (_smtp._tls TXT), so no reports about failed encrypted deliveries are received."
}
],
"note": "Reads public DNS records through DNS-over-HTTPS and judges the published records against RFC 7208 (SPF), RFC 7489 (DMARC), RFC 6376 (DKIM), RFC 8461 (MTA-STS), RFC 8460 (TLS-RPT) and the BIMI draft. The grade is a heuristic score of those records, not proof that mail authenticates. It does not send mail, verify message signatures, test deliverability, fetch the MTA-STS policy file or expand a/mx/exists targets in SPF. Without selector= only common DKIM selectors are tried. The DMARC organizational domain is approximated."
}
curl --location --request GET 'https://zylalabs.com/api/14333/email+authentication+check+api/35927/check+a+domain+spf+dmarc+dkim+and+bimi+records?domain=github.com' --header 'Authorization: Bearer YOUR_API_KEY'
{
"grade": "A",
"score": 90,
"summary": {
"errors": 0,
"warnings": 1,
"infos": 0
},
"spf": {
"record": "v=spf1 include:_spf.google.com ~all",
"qualifierAll": "~",
"mechanisms": 2,
"dnsLookups": 1,
"lookupLimit": 10,
"includes": [
"_spf.google.com"
],
"redirect": null
},
"dmarc": {
"record": "v=DMARC1; p=none; rua=mailto:[email protected]",
"policy": "none",
"subdomainPolicy": null,
"effectivePolicyForQueriedDomain": "none",
"pct": 100,
"rua": [
"mailto:[email protected]"
],
"alignment": {
"dkim": "r",
"spf": "r"
},
"inheritedFrom": null
},
"issues": [
{
"severity": "warning",
"code": "dmarc_policy_none",
"message": "p=none is monitoring only; spoofed mail is still delivered. Move to quarantine or reject once reports look clean."
}
],
"assumptions": {
"note": "Validated offline: no DNS queries were made, so include chains are not followed and the SPF lookup count only covers terms in the text you sent."
},
"checkedAt": "2026-10-21T14:09:46.208Z"
}
curl --location --request POST 'https://zylalabs.com/api/14333/email+authentication+check+api/35928/validate+spf+dmarc+and+dkim+record+text+you+send+in' --header 'Authorization: Bearer YOUR_API_KEY'
--data-raw '{"spf":"v=spf1 include:_spf.google.com ~all","dmarc":"v=DMARC1; p=none; rua=mailto:[email protected]"}'
After signing up, every developer is assigned a personal API access key, a unique combination of letters and digits provided to access to our API endpoint. To authenticate with the Email Authentication Check API simply include your bearer token in the Authorization header.
| Header | Description |
|---|---|
Authorization
|
Required
Should be Bearer access_key. See "Your API Access Key" above when you are subscribed.
|
No long-term commitment. Upgrade, downgrade, or cancel anytime. Free Trial includes up to 50 requests.
Check the SPF, DMARC and DKIM records of any domain and get coded issues, a grade and a score, plus MTA-STS, TLS-RPT, BIMI and MX checks.
SPF, DMARC and DKIM records for a domain, plus MTA-STS, TLS-RPT, BIMI and MX presence. It returns the parsed records, coded issues, a grade and a score.
It reads public DNS records only. It does not send test emails, does not fetch the MTA-STS policy file and cannot prove that a DKIM key is absent, because the selector may simply be unknown.
Pass selector with one or more comma separated names, up to 5, such as google or selector1,selector2. Without it a short list of common selectors is tried.
It checks SPF, DMARC or DKIM record text that you send in the request body. It is offline, makes no DNS lookups and is useful for records you have not published yet.
Yes. Results are cached for 15 minutes. Add the fresh parameter set to 1 to bypass the cache, for example right after you change a DNS record.
To obtain your API key, first sign in to your account and navigate to the API you want to use. From the API's Pricing section, choose a plan and complete the subscription process. Once subscribed, return to the API page and you will see your API Access Key displayed at the top of the documentation page. You can use this key to authenticate your requests.
You can’t switch APIs during the free trial. If you subscribe to a different API, your trial will end and the new subscription will start as a paid plan.
The free trial lasts for 7 days and allows you to make up to 50 API requests.
No, the free trial is available only once, so we recommend using it on the API that interests you the most. Most of our APIs offer a free trial, but some may not include this option.
Yes. If the API offers a free trial, you will see a "Free 7-Day Trial" option in its Pricing section. The trial lasts for 7 days and allows up to 50 API requests, enabling you to evaluate the API before subscribing to a paid plan.
Zyla API Hub is like a big store for APIs, where you can find thousands of them all in one place. We also offer dedicated support and real-time monitoring of all APIs. Once you sign up, you can pick and choose which APIs you want to use. Just remember, each API needs its own subscription. But if you subscribe to multiple ones, you'll use the same key for all of them, making things easier for you.
You can monitor your API usage through the response headers included with every request:
x-zyla-api-calls-monthly-used: Shows the total number of API requests you have used during the current billing period.
x-zyla-api-calls-monthly-remaining: Shows the number of API requests you have remaining for the current billing period.
Yes, you can cancel your subscription at any time. Simply go to the Pricing section of the API you're subscribed to and click the "Unsubscribe" button.
Please note that upgrades, downgrades, and cancellations take effect immediately. Once your subscription is canceled, access to the service will end immediately, regardless of any remaining API calls in your quota.
Please have a look at our Refund Policy: https://zylalabs.com/terms#refund