Email Authentication Check API

API ID 14333

Check the SPF, DMARC and DKIM records of any domain and get coded issues, a grade and a score, plus MTA-STS, TLS-RPT, BIMI and MX checks.

API Documentation

Endpoints

Request
Returns a graded report of the email authentication records for the given domain.
Endpoint ID: 35927
GET https://zylalabs.com/api/14333/email+authentication+check+api/35927/check+a+domain+spf+dmarc+dkim+and+bimi+records
INPUT PARAMETERS

Check a domain SPF DMARC DKIM and BIMI records — Endpoint Features

Object Description
domain Required Domain to check, e.g. github.com. An email address or URL is reduced to its domain. Other common parameter names such as d, host, site, name, url and email are also accepted.
selector Optional DKIM selector s to look up, comma separated, at most 5 for example google or selector1,selector2 . Without it a short list of common selectors is tried.
fresh Optional Set to 1 to bypass the 15-minute result cache.

Free test requests remaining: 3 of 3.


INPUT PARAMETERS

domain
selector
fresh
API EXAMPLE RESPONSE
JSON
{
    "domain": "github.com",
    "cached": false,
    "checkedAt": "2026-10-21T14:09:42.267Z",
    "grade": "D",
    "score": 68,
    "summary": {
        "errors": 0,
        "warnings": 3,
        "infos": 2
    },
    "spf": {
        "record": "v=spf1 ip4:192.30.252.0/22 include:spf.protection.outlook.com include:_netblocks.google.com include:_netblocks2.google.com include:mail.zendesk.com include:_spf.salesforce.com include:servers.mcsv.net include:mktomail.com include:sendgrid.net ip4:62.253.227.114 ip4:166.78.69.169 ip4:166.78.69.170 ip4:166.78.71.131 ~all",
        "qualifierAll": "~",
        "mechanisms": 14,
        "dnsLookups": 10,
        "lookupLimit": 10,
        "includes": [
            "spf.protection.outlook.com",
            "_netblocks.google.com",
            "_netblocks2.google.com",
            "mail.zendesk.com",
            "_spf.salesforce.com",
            "servers.mcsv.net",
            "mktomail.com",
            "sendgrid.net"
        ],
        "redirect": null,
        "resolvedTree": [
            {
                "domain": "spf.protection.outlook.com",
                "via": "include",
                "depth": 1
            },
            {
                "domain": "_netblocks.google.com",
                "via": "include",
                "depth": 1
            },
            {
                "domain": "_netblocks2.google.com",
                "via": "include",
                "depth": 1
            },
            {
                "domain": "mail.zendesk.com",
                "via": "include",
                "depth": 1
            },
            {
                "domain": "_spf.salesforce.com",
                "via": "include",
                "depth": 1
            },
            {
                "domain": "servers.mcsv.net",
                "via": "include",
                "depth": 1
            },
            {
                "domain": "mktomail.com",
                "via": "include",
                "depth": 1
            },
            {
                "domain": "sendgrid.net",
                "via": "include",
                "depth": 1
            },
            {
                "domain": "ab.sendgrid.net",
                "via": "include",
                "depth": 2
            }
        ]
    },
    "dmarc": {
        "record": "v=DMARC1; p=quarantine; sp=reject; pct=100; rua=mailto:[email protected]; ruf=mailto:[email protected]; fo=1",
        "policy": "quarantine",
        "subdomainPolicy": "reject",
        "effectivePolicyForQueriedDomain": "quarantine",
        "pct": 100,
        "rua": [
            "mailto:[email protected]"
        ],
        "alignment": {
            "dkim": "r",
            "spf": "r"
        },
        "inheritedFrom": null
    },
    "dkim": {
        "selectorsChecked": [
            "google",
            "selector1",
            "selector2",
            "k1",
            "k2",
            "default",
            "s1",
            "s2",
            "mail",
            "dkim"
        ],
        "selectorsProvided": false,
        "keys": [
            {
                "selector": "google",
                "found": true,
                "record": "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAj6T5sl/RwdSqGoYWaWaFbS2UAeyPrEmd0gogocmRfS441qwR8/0KB81Hw89P0l4YiFRrXYk7NVIGfyCRHAYYZUzCkGeOysI2EjgzLFhd/NEsbRzOEc/kWkK/RO6JFq/5lOn6M9AZw/ap9tds4JG9ApgNNdSpPxp9DmvpsOSgNMVflRxQFrk3kdS4RNAPKu/OPoA7dlR/A/pECryjRoYgENtDXzdnK70HgCekems6UDzxDj61cjyoKoXtEMF/QsaHEQ1Gjfv014rDJBsubk/kT5VqHkWHa/ia68Z5r228Ety/wFfQNjXTx/J7KGZ9GkZlKED659eiJcLnWcKDSi…",
                "keyType": "rsa",
                "keyBits": 2048,
                "revoked": false,
                "testing": false
            },
            {
                "selector": "selector1",
                "found": true,
                "record": "v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCxZC/z2cK+2s1f/ktzSDSeFzkfIHrjwtGFsfKMAYvKaXjPVNzKykpbXBkX5nB7dVUTFttda7aROr2iSrIseQ27Ui+4rUZVzgFanE8RaXhYM9n5wPKNv8GtLJk7JgcsYZ7ErgID4uW2sEYyV/dnRYw6rDzOaeRKkKELTUfJI5ebLQIDAQAB;",
                "keyType": "rsa",
                "keyBits": 1024,
                "revoked": false,
                "testing": false
            },
            {
                "selector": "k1",
                "found": true,
                "record": "k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDbNrX2cY/GUKIFx2G/1I00ftdAj713WP9AQ1xir85i89sA2guU0ta4UX1Xzm06XIU6iBP41VwmPwBGRNofhBVR+e6WHUoNyIR4Bn84LVcfZE20rmDeXQblIupNWBqLXM1Q+VieI/eZu/7k9/vOkLSaQQdml4Cv8lb3PcnluMVIhQIDAQAB;",
                "keyType": "rsa",
                "keyBits": 1024,
                "revoked": false,
                "testing": false
            },
            {
                "selector": "k2",
                "found": true,
                "record": "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAv2aC2KjGKLOwTweBY5A9RpjsxaBXR9r7OAU6U8/zn92ivImI75naUujWbItRI/QmL1jy5PWGqLwoUA0b90ObWaLDc+i9MtTNmGeWO009hr20fIxhGg6XBT2kjZ1DTThopSe1nAndsupmcBwlQ5Q6LJ+ZAxLcujnPIxM0ZBLmgpkv8u6RfY4eFP8OLvdAW3oSuB0DyLDigQX4Sj8wBO4YIdQH6AAmBeOsidsKAFNFUCpc3vCxtBDR12U+cBg724l3sBkMQ8evnz6idnqxq9QAVYh8k4kJ+RP+6cqTdy7LjIm8xY/bQNpQIpGUAuDo2DjLcCDun9DAI4Q/3z+Q0o…",
                "keyType": "rsa",
                "keyBits": 2048,
                "revoked": false,
                "testing": false
            },
            {
                "selector": "s1",
                "found": true,
                "record": "k=rsa; t=s; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAyn3fMCVpb7ryIRKOGXhXVGYmsWUitNlSckqGHOwNFZgFadplOrD+Qzf1XQkP7MH/VB/97DsAAJGtEXW1Uq71Hjnfr/DuBN/YfjF/gU70qEFb7q1sdIiNtjFL2TkOpoW+X/bhhPNheW/fYwyFb6ZHFM6LTgXyuimWRHTOUP3VjZzhNVda79nt+2WZYbS4l8HdMgWpTNHjpVw5PtXESA9KBg/evSRk5fIaXIX5eRXW3baoV9yVzD8O29/IL/DiSk+yNvaO0EHL5c4yGuZJhGzvpiznb2IDVdemJK4Dqzdy5FTN/SGYZhAEr7MguG3Z314hMS2scgMsOMgB64uj/6+6Uw…",
                "keyType": "rsa",
                "keyBits": 2048,
                "revoked": false,
                "testing": false
            },
            {
                "selector": "s2",
                "found": true,
                "record": "k=rsa; t=s; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAnNt2/H6bKs99C6DAaokPp62KN9mKaD20D1PBakkObejkJvzM6Un/fKHPeI2/qXdvFFBPQE3mxMNoe+hwBVDgMgCuZEn8J6gZYI4amITure9/ny6+GaNVRoH2m6xAtWwKINkKxMayGiehkWlRVb7D23F0U8y+VDHKQFz1bnXA5jDpcDiMXy8i2lV5vEys+qt+1WGhDKCAwamT8c3xkZz8aXMJaXYCiN2HMgHDU81+mVCk4+u6mY+a98APVfFhsQ0KCq/mVZXaXTV06QrG9M5PtBHUFW7VtwXKp+AFrAut0KW1NnwaA5IGA5sc+n9dma7bSqdfGS+ixdSmJ69NwmYSHw…",
                "keyType": "rsa",
                "keyBits": 2048,
                "revoked": false,
                "testing": false
            }
        ]
    },
    "mx": {
        "records": [
            {
                "priority": 0,
                "host": "github-com.mail.protection.outlook.com"
            }
        ],
        "nullMx": false,
        "hasMail": true
    },
    "mtaSts": null,
    "tlsRpt": null,
    "bimi": null,
    "issues": [
        {
            "severity": "warning",
            "code": "spf_lookups_near_limit",
            "message": "The SPF evaluation uses 10 of the 10 allowed DNS-querying terms; adding another include may break SPF."
        },
        {
            "severity": "warning",
            "code": "dkim_key_1024",
            "message": "selector1._domainkey: the RSA key is 1024 bits; 2048 bits is the current recommendation."
        },
        {
            "severity": "warning",
            "code": "dkim_key_1024",
            "message": "k1._domainkey: the RSA key is 1024 bits; 2048 bits is the current recommendation."
        },
        {
            "severity": "info",
            "code": "mta_sts_missing",
            "message": "No MTA-STS record (_mta-sts TXT). MTA-STS lets receiving domains require TLS for inbound mail; it matters mainly for domains that receive mail."
        },
        {
            "severity": "info",
            "code": "tls_rpt_missing",
            "message": "No TLS-RPT record (_smtp._tls TXT), so no reports about failed encrypted deliveries are received."
        }
    ],
    "note": "Reads public DNS records through DNS-over-HTTPS and judges the published records against RFC 7208 (SPF), RFC 7489 (DMARC), RFC 6376 (DKIM), RFC 8461 (MTA-STS), RFC 8460 (TLS-RPT) and the BIMI draft. The grade is a heuristic score of those records, not proof that mail authenticates. It does not send mail, verify message signatures, test deliverability, fetch the MTA-STS policy file or expand a/mx/exists targets in SPF. Without selector= only common DKIM selectors are tried. The DMARC organizational domain is approximated."
}
Check a domain SPF DMARC DKIM and BIMI records — CODE SNIPPETS

curl --location --request GET 'https://zylalabs.com/api/14333/email+authentication+check+api/35927/check+a+domain+spf+dmarc+dkim+and+bimi+records?domain=github.com' --header 'Authorization: Bearer YOUR_API_KEY' 


    
Request
Checks SPF DMARC or DKIM record text sent in the request body. Offline with no lookups. Send at least one of spf, dmarc or dkim.
Endpoint ID: 35928
POST https://zylalabs.com/api/14333/email+authentication+check+api/35928/validate+spf+dmarc+and+dkim+record+text+you+send+in
INPUT PARAMETERS

Validate SPF DMARC and DKIM record text you send in — Endpoint Features

Object Description
Request Body Required Json

Free test requests remaining: 3 of 3.


INPUT PARAMETERS

API EXAMPLE RESPONSE
JSON
{
    "grade": "A",
    "score": 90,
    "summary": {
        "errors": 0,
        "warnings": 1,
        "infos": 0
    },
    "spf": {
        "record": "v=spf1 include:_spf.google.com ~all",
        "qualifierAll": "~",
        "mechanisms": 2,
        "dnsLookups": 1,
        "lookupLimit": 10,
        "includes": [
            "_spf.google.com"
        ],
        "redirect": null
    },
    "dmarc": {
        "record": "v=DMARC1; p=none; rua=mailto:[email protected]",
        "policy": "none",
        "subdomainPolicy": null,
        "effectivePolicyForQueriedDomain": "none",
        "pct": 100,
        "rua": [
            "mailto:[email protected]"
        ],
        "alignment": {
            "dkim": "r",
            "spf": "r"
        },
        "inheritedFrom": null
    },
    "issues": [
        {
            "severity": "warning",
            "code": "dmarc_policy_none",
            "message": "p=none is monitoring only; spoofed mail is still delivered. Move to quarantine or reject once reports look clean."
        }
    ],
    "assumptions": {
        "note": "Validated offline: no DNS queries were made, so include chains are not followed and the SPF lookup count only covers terms in the text you sent."
    },
    "checkedAt": "2026-10-21T14:09:46.208Z"
}
Validate SPF DMARC and DKIM record text you send in — CODE SNIPPETS

curl --location --request POST 'https://zylalabs.com/api/14333/email+authentication+check+api/35928/validate+spf+dmarc+and+dkim+record+text+you+send+in' --header 'Authorization: Bearer YOUR_API_KEY' 

--data-raw '{"spf":"v=spf1 include:_spf.google.com ~all","dmarc":"v=DMARC1; p=none; rua=mailto:[email protected]"}'

    

API Access Key & Authentication

After signing up, every developer is assigned a personal API access key, a unique combination of letters and digits provided to access to our API endpoint. To authenticate with the Email Authentication Check API simply include your bearer token in the Authorization header.

Headers
Header Description
Authorization Required Should be Bearer access_key. See "Your API Access Key" above when you are subscribed.

No long-term commitment. Upgrade, downgrade, or cancel anytime. Free Trial includes up to 50 requests.

Starts at
$10,000/Year


  • Custom Volume
  • Custom Rate Limit
  • Specialized Customer Support
  • Real-Time API Monitoring

Overview

Check the SPF, DMARC and DKIM records of any domain and get coded issues, a grade and a score, plus MTA-STS, TLS-RPT, BIMI and MX checks.

Email Authentication Check API FAQs

SPF, DMARC and DKIM records for a domain, plus MTA-STS, TLS-RPT, BIMI and MX presence. It returns the parsed records, coded issues, a grade and a score.

It reads public DNS records only. It does not send test emails, does not fetch the MTA-STS policy file and cannot prove that a DKIM key is absent, because the selector may simply be unknown.

Pass selector with one or more comma separated names, up to 5, such as google or selector1,selector2. Without it a short list of common selectors is tried.

It checks SPF, DMARC or DKIM record text that you send in the request body. It is offline, makes no DNS lookups and is useful for records you have not published yet.

Yes. Results are cached for 15 minutes. Add the fresh parameter set to 1 to bypass the cache, for example right after you change a DNS record.

General FAQs

To obtain your API key, first sign in to your account and navigate to the API you want to use. From the API's Pricing section, choose a plan and complete the subscription process. Once subscribed, return to the API page and you will see your API Access Key displayed at the top of the documentation page. You can use this key to authenticate your requests.

You can’t switch APIs during the free trial. If you subscribe to a different API, your trial will end and the new subscription will start as a paid plan.

The free trial lasts for 7 days and allows you to make up to 50 API requests.

No, the free trial is available only once, so we recommend using it on the API that interests you the most. Most of our APIs offer a free trial, but some may not include this option.

Yes. If the API offers a free trial, you will see a "Free 7-Day Trial" option in its Pricing section. The trial lasts for 7 days and allows up to 50 API requests, enabling you to evaluate the API before subscribing to a paid plan.

Zyla API Hub is like a big store for APIs, where you can find thousands of them all in one place. We also offer dedicated support and real-time monitoring of all APIs. Once you sign up, you can pick and choose which APIs you want to use. Just remember, each API needs its own subscription. But if you subscribe to multiple ones, you'll use the same key for all of them, making things easier for you.

Prices are listed in USD (United States Dollar), EUR (Euro), CAD (Canadian Dollar), AUD (Australian Dollar), and GBP (British Pound). We accept all major debit and credit cards. Our payment system uses the latest security technology and is powered by Stripe, one of the world's most reliable payment companies. If you have any trouble paying by card, just contact us at [email protected]

Additionally, if you already have an active subscription in any of these currencies (USD, EUR, CAD, AUD, GBP), that currency will remain for subsequent subscriptions. You can change the currency at any time as long as you don't have any active subscriptions.
The local currency shown on the pricing page is based on the country of your IP address and is provided for reference only. The actual prices are in USD (United States Dollar). When you make a payment, the charge will appear on your card statement in USD, even if you see the equivalent amount in your local currency on our website. This means you cannot pay directly with your local currency.
Occasionally, a bank may decline the charge due to its fraud protection settings. We suggest reaching out to your bank initially to check if they are blocking our charges. Also, you can access the Billing Portal and change the card associated to make the payment. If these does not work and you need further assistance, please contact our team at [email protected]
Prices are determined by a recurring monthly or yearly subscription, depending on the chosen plan.
API calls are deducted from your plan based on successful requests. Each plan comes with a specific number of calls that you can make per month. Only successful calls, indicated by a Status 200 response, will be counted against your total. This ensures that failed or incomplete requests do not impact your monthly quota.
Zyla API Hub works on a recurring monthly subscription system. Your billing cycle will start the day you purchase one of the paid plans, and it will renew the same day of the next month. So be aware to cancel your subscription beforehand if you want to avoid future charges.
To upgrade your current subscription plan, simply go to the pricing page of the API and select the plan you want to upgrade to. The upgrade will be instant, allowing you to immediately enjoy the features of the new plan. Please note that any remaining calls from your previous plan will not be carried over to the new plan, so be aware of this when upgrading. You will be charged the full amount of the new plan.
To check how many API calls you have left for the current month, refer to the 'X-Zyla-API-Calls-Monthly-Remaining' field in the response header. For example, if your plan allows 1,000 requests per month and you've used 100, this field in the response header will indicate 900 remaining calls.

You can monitor your API usage through the response headers included with every request:

x-zyla-api-calls-monthly-used: Shows the total number of API requests you have used during the current billing period.
x-zyla-api-calls-monthly-remaining: Shows the number of API requests you have remaining for the current billing period.

The 'X-Zyla-RateLimit-Reset' header shows the number of seconds until your rate limit resets. This tells you when your request count will start fresh. For example, if it displays 3,600, it means 3,600 seconds are left until the limit resets.

Yes, you can cancel your subscription at any time. Simply go to the Pricing section of the API you're subscribed to and click the "Unsubscribe" button.

Please note that upgrades, downgrades, and cancellations take effect immediately. Once your subscription is canceled, access to the service will end immediately, regardless of any remaining API calls in your quota.

After 7 days, you will be charged the full amount for the plan you were subscribed to during the trial. Therefore, it's important to cancel before the trial period ends. Refund requests for forgetting to cancel on time are not accepted.
When you subscribe to an API free trial, you can make up to 50 API calls. If you wish to make additional API calls beyond this limit, the API will prompt you to perform an "Start Your Paid Plan." You can find the "Start Your Paid Plan" button in your profile under Subscription -> Choose the API you are subscribed to -> Pricing tab.
You can contact us through our chat channel to receive immediate assistance. We are always online from 8 am to 5 pm (EST). If you reach us after that time, we will get back to you as soon as possible. Additionally, you can contact us via email at [email protected]

Please have a look at our Refund Policy: https://zylalabs.com/terms#refund


Related APIs