{
"scope": "DomainTrust Audit joins two checks, each with a stated limit. The audit leg verifies, from public DNS records, whether the domain publishes MX, SPF and DMARC (with its policy), and whether DKIM records exist under 12 common selectors; it returns a configuration-completeness score (0-100) and an issues list. It does not measure inbox deliverability, sender reputation, or whether mail is actually signed, and a DKIM 'not found' means only that none of the 12 common selectors holds a record. Two readings to know: a null MX record (RFC 7505, 'this domain accepts no mail') currently counts as MX present and raises no issue, and a DKIM selector holding an empty or revoked key counts as found - 'found' means a DKIM-shaped record exists there, not that the key is usable. The email leg screens addresses at domain level only (syntax, domain and MX existence, disposable signals, domain age) - it does not probe whether a mailbox exists, and its catch-all field is a risk signal inferred from MX/provider patterns, never a probed conclusion. Flagged addresses are grouped by whether their domain is the audited domain; that grouping is shown so configuration findings and address findings can be read side by side - it is a grouping, not proof of what caused any single flag.",
"domain": "example.com",
"audit": {
"domain": "example.com",
"score": 98,
"grade": "A",
"checks": {
"mx": {
"present": true,
"records": [
"0 ."
]
},
"spf": {
"present": true,
"records": [
"v=spf1 -all"
]
},
"dmarc": {
"present": true,
"records": [
"v=DMARC1;p=reject;sp=reject;adkim=s;aspf=s"
],
"policy": "reject"
},
"dkim": {
"commonSelectorFound": true,
"selectorsFound": [
"selector1",
"selector2",
"dkim",
"default",
"mail",
"google",
"s1",
"k1",
"s2",
"k2",
"smtp",
"mandrill"
],
"selectorsChecked": [
"default",
"google",
"selector1",
"selector2",
"mail",
"dkim",
"s1",
"s2",
"k1",
"k2",
"mandrill",
"smtp"
],
"coverageNote": "Only the common selectors listed in selectorsChecked are probed. Domains that sign with a custom selector (common for large senders — e.g. Google signs with date-based selectors such as 20230601) are NOT detected by this check, so a 'not found' result here does not prove DKIM is missing or that mail is unsigned."
}
},
"issues": [
{
"severity": "info",
"check": "dmarc",
"message": "DMARC record has no rua= reporting address — you will not receive aggregate reports."
}
],
"source": "DNS-over-HTTPS (Cloudflare)"
},
"emails": {
"results": [
{
"email": "[email protected]",
"valid": true,
"score": 100,
"verdict": "valid",
"checks": {
"syntax": true,
"domainExists": true,
"mxFound": true,
"disposable": false,
"roleAccount": false,
"freeProvider": false
},
"mxRecords": [],
"suggestion": null,
"typoLikely": false,
"domainAgeDays": 11410,
"domainAgeSource": "RDAP",
"catchAllRisk": "unknown",
"note": "Checks domain mail routing (MX) and risk signals. Does not probe individual mailbox existence. Catch-all risk is a risk signal based on MX/provider patterns, not a probing conclusion."
},
{
"email": "[email protected]",
"valid": true,
"score": 100,
"verdict": "valid",
"checks": {
"syntax": true,
"domainExists": true,
"mxFound": true,
"disposable": false,
"roleAccount": false,
"freeProvider": false
},
"mxRecords": [],
"suggestion": null,
"typoLikely": false,
"domainAgeDays": 11410,
"domainAgeSource": "RDAP",
"catchAllRisk": "unknown",
"note": "Checks domain mail routing (MX) and risk signals. Does not probe individual mailbox existence. Catch-all risk is a risk signal based on MX/provider patterns, not a probing conclusion."
}
],
"summary": {
"total": 2,
"valid": {
"count": 2,
"percent": 100
},
"risky": {
"count": 0,
"percent": 0
},
"invalid": {
"count": 0,
"percent": 0
},
"disposable": {
"count": 0,
"percent": 0
},
"typoLikely": {
"count": 0,
"percent": 0
}
}
},
"summary": {
"audit": {
"score": 98,
"grade": "A",
"issueCount": 1,
"issuesBySeverity": {
"error": 0,
"warning": 0,
"info": 1
}
},
"addresses": {
"total": 2,
"valid": 2,
"risky": 0,
"invalid": 0,
"disposable": 0,
"typoLikely": 0
},
"flagged": {
"total": 0,
"domainContext": {
"count": 0,
"byVerdict": {
"risky": 0,
"invalid": 0
},
"addresses": []
},
"addressLevel": {
"count": 0,
"byVerdict": {
"risky": 0,
"invalid": 0
},
"addresses": []
},
"note": "Flagged = the email leg's risky + invalid verdicts, grouped by whether the address's domain is the audited domain. Addresses grouped under domainContext sit next to the domain's own configuration findings in the audit block above; addressLevel flags rest on the address's own signals (listed per address) or on a different domain. Grouping only - it does not prove what caused any single flag."
}
}
}
curl --location --request POST 'https://zylalabs.com/api/14803/domaintrust+audit+api/38381/audit+domain' --header 'Authorization: Bearer YOUR_API_KEY'
--data-raw '{"domain": "example.com", "emails": ["[email protected]", "[email protected]"]}'
{
"ok": true,
"service": "DomainTrust Audit",
"version": 1
}
curl --location --request GET 'https://zylalabs.com/api/14803/domaintrust+audit+api/38382/health+check' --header 'Authorization: Bearer YOUR_API_KEY'
After signing up, every developer is assigned a personal API access key, a unique combination of letters and digits provided to access to our API endpoint. To authenticate with the DomainTrust Audit API simply include your bearer token in the Authorization header.
| Header | Description |
|---|---|
Authorization
|
Required
Should be Bearer access_key. See "Your API Access Key" above when you are subscribed.
|
No long-term commitment. Upgrade, downgrade, or cancel anytime.
Domain mail-authentication audit API: MX, SPF, DMARC and DKIM-selector checks from public DNS, a 0-100 configuration completeness score, plus address screening.
No. The score counts configuration completeness — which of MX, SPF, DMARC and DKIM-under-common-selectors are published, and how the records are set. Delivery depends on sender reputation, content and receiver policy, none of which this API reads or claims to read.
No. It means none of the 12 common selectors holds a record. Domains that sign with a custom selector (common for large senders) are not detected by this check, and the response's coverage note says so.
No. It checks domain mail routing (MX), registration data and risk signals at domain level. Mailbox-level probing is unreliable, so we do not do it and do not claim it.
Yes. One call takes exactly one domain and, optionally, up to 100 addresses. Omit the emails field to audit the domain only.
The audit leg and the address leg run in parallel and fail independently: if one engine is unreachable, the other leg's results are still returned, with a named error in the failed leg's block.
To obtain your API key, first sign in to your account and navigate to the API you want to use. From the API's Pricing section, choose a plan and complete the subscription process. Once subscribed, return to the API page and you will see your API Access Key displayed at the top of the documentation page. You can use this key to authenticate your requests.
You can’t switch APIs during the free trial. If you subscribe to a different API, your trial will end and the new subscription will start as a paid plan.
The free trial lasts for 7 days and allows you to make up to 50 API requests.
No, the free trial is available only once, so we recommend using it on the API that interests you the most. Most of our APIs offer a free trial, but some may not include this option.
Yes. If the API offers a free trial, you will see a "Free 7-Day Trial" option in its Pricing section. The trial lasts for 7 days and allows up to 50 API requests, enabling you to evaluate the API before subscribing to a paid plan.
Zyla API Hub is like a big store for APIs, where you can find thousands of them all in one place. We also offer dedicated support and real-time monitoring of all APIs. Once you sign up, you can pick and choose which APIs you want to use. Just remember, each API needs its own subscription. But if you subscribe to multiple ones, you'll use the same key for all of them, making things easier for you.
You can monitor your API usage through the response headers included with every request:
x-zyla-api-calls-monthly-used: Shows the total number of API requests you have used during the current billing period.
x-zyla-api-calls-monthly-remaining: Shows the number of API requests you have remaining for the current billing period.
Yes, you can cancel your subscription at any time. Simply go to the Pricing section of the API you're subscribed to and click the "Unsubscribe" button.
Please note that upgrades, downgrades, and cancellations take effect immediately. Once your subscription is canceled, access to the service will end immediately, regardless of any remaining API calls in your quota.
Please have a look at our Refund Policy: https://zylalabs.com/terms#refund