{
"scope": "DomainTrust Audit joins two checks, each with a stated limit. The audit leg verifies, from public DNS records, whether the domain publishes MX, SPF and DMARC (with its policy), and whether DKIM records exist under 12 common selectors; it returns a configuration-completeness score (0-100) and an issues list. It does not measure inbox deliverability, sender reputation, or whether mail is actually signed, and a DKIM 'not found' means only that none of the 12 common selectors holds a record. Two readings to know: a null MX record (RFC 7505, 'this domain accepts no mail') currently counts as MX present and raises no issue, and a DKIM selector holding an empty or revoked key counts as found - 'found' means a DKIM-shaped record exists there, not that the key is usable. The email leg screens addresses at domain level only (syntax, domain and MX existence, disposable signals, domain age) - it does not probe whether a mailbox exists, and its catch-all field is a risk signal inferred from MX/provider patterns, never a probed conclusion. Flagged addresses are grouped by whether their domain is the audited domain; that grouping is shown so configuration findings and address findings can be read side by side - it is a grouping, not proof of what caused any single flag.",
"domain": "example.com",
"audit": {
"domain": "example.com",
"score": 98,
"grade": "A",
"checks": {
"mx": {
"present": true,
"records": [
"0 ."
]
},
"spf": {
"present": true,
"records": [
"v=spf1 -all"
]
},
"dmarc": {
"present": true,
"records": [
"v=DMARC1;p=reject;sp=reject;adkim=s;aspf=s"
],
"policy": "reject"
},
"dkim": {
"commonSelectorFound": true,
"selectorsFound": [
"selector1",
"selector2",
"dkim",
"default",
"mail",
"google",
"s1",
"k1",
"s2",
"k2",
"smtp",
"mandrill"
],
"selectorsChecked": [
"default",
"google",
"selector1",
"selector2",
"mail",
"dkim",
"s1",
"s2",
"k1",
"k2",
"mandrill",
"smtp"
],
"coverageNote": "Only the common selectors listed in selectorsChecked are probed. Domains that sign with a custom selector (common for large senders — e.g. Google signs with date-based selectors such as 20230601) are NOT detected by this check, so a 'not found' result here does not prove DKIM is missing or that mail is unsigned."
}
},
"issues": [
{
"severity": "info",
"check": "dmarc",
"message": "DMARC record has no rua= reporting address — you will not receive aggregate reports."
}
],
"source": "DNS-over-HTTPS (Cloudflare)"
},
"emails": {
"results": [
{
"email": "[email protected]",
"valid": true,
"score": 100,
"verdict": "valid",
"checks": {
"syntax": true,
"domainExists": true,
"mxFound": true,
"disposable": false,
"roleAccount": false,
"freeProvider": false
},
"mxRecords": [],
"suggestion": null,
"typoLikely": false,
"domainAgeDays": 11410,
"domainAgeSource": "RDAP",
"catchAllRisk": "unknown",
"note": "Checks domain mail routing (MX) and risk signals. Does not probe individual mailbox existence. Catch-all risk is a risk signal based on MX/provider patterns, not a probing conclusion."
},
{
"email": "[email protected]",
"valid": true,
"score": 100,
"verdict": "valid",
"checks": {
"syntax": true,
"domainExists": true,
"mxFound": true,
"disposable": false,
"roleAccount": false,
"freeProvider": false
},
"mxRecords": [],
"suggestion": null,
"typoLikely": false,
"domainAgeDays": 11410,
"domainAgeSource": "RDAP",
"catchAllRisk": "unknown",
"note": "Checks domain mail routing (MX) and risk signals. Does not probe individual mailbox existence. Catch-all risk is a risk signal based on MX/provider patterns, not a probing conclusion."
}
],
"summary": {
"total": 2,
"valid": {
"count": 2,
"percent": 100
},
"risky": {
"count": 0,
"percent": 0
},
"invalid": {
"count": 0,
"percent": 0
},
"disposable": {
"count": 0,
"percent": 0
},
"typoLikely": {
"count": 0,
"percent": 0
}
}
},
"summary": {
"audit": {
"score": 98,
"grade": "A",
"issueCount": 1,
"issuesBySeverity": {
"error": 0,
"warning": 0,
"info": 1
}
},
"addresses": {
"total": 2,
"valid": 2,
"risky": 0,
"invalid": 0,
"disposable": 0,
"typoLikely": 0
},
"flagged": {
"total": 0,
"domainContext": {
"count": 0,
"byVerdict": {
"risky": 0,
"invalid": 0
},
"addresses": []
},
"addressLevel": {
"count": 0,
"byVerdict": {
"risky": 0,
"invalid": 0
},
"addresses": []
},
"note": "Flagged = the email leg's risky + invalid verdicts, grouped by whether the address's domain is the audited domain. Addresses grouped under domainContext sit next to the domain's own configuration findings in the audit block above; addressLevel flags rest on the address's own signals (listed per address) or on a different domain. Grouping only - it does not prove what caused any single flag."
}
}
}
curl --location --request POST 'https://zylalabs.com/api/14803/domaintrust+audit+api/38381/audit+domain' --header 'Authorization: Bearer YOUR_API_KEY'
--data-raw '{"domain": "example.com", "emails": ["[email protected]", "[email protected]"]}'
{
"ok": true,
"service": "DomainTrust Audit",
"version": 1
}
curl --location --request GET 'https://zylalabs.com/api/14803/domaintrust+audit+api/38382/health+check' --header 'Authorization: Bearer YOUR_API_KEY'
Después de registrarte, a cada desarrollador se le asigna una clave de acceso a la API personal, una combinación única de letras y dígitos proporcionada para acceder a nuestro endpoint de la API. Para autenticarte con el Auditoría de DomainTrust API simplemente incluye tu token de portador en el encabezado de Autorización.
| Encabezado | Descripción |
|---|---|
Autorización
|
Requerido
Debería ser Bearer access_key. Consulta "Tu Clave de Acceso a la API" arriba cuando estés suscrito.
|
Sin compromiso a largo plazo. Mejora, reduce o cancela en cualquier momento.
API de auditoría de autenticación de correo del dominio: verificaciones de MX, SPF, DMARC y seleccionador DKIM desde DNS público, una puntuación de completitud de configuración de 0 a 100, además de selección de direcciones
No La puntuación cuenta la completitud de la configuración — cuáles de MX SPF DMARC y DKIM-bajo-selectores-comunes están publicados y cómo se configuran los registros La entrega depende de la reputación del remitente del contenido y de la política del receptor ninguno de los cuales esta API lee o afirma leer
No. Significa que ninguno de los 12 selectores comunes posee un registro Los dominios que firman con un selector personalizado común para grandes remitentes no son detectados por esta verificación y la nota de cobertura de la respuesta así lo indica
No verifica el enrutamiento de correo del dominio MX los datos de registro y las señales de riesgo a nivel de dominio La verificación a nivel de buzón es poco fiable por lo que no la realizamos y no lo afirmamos
Sí Una llamada toma exactamente un dominio y opcionalmente hasta 100 direcciones Omitir el campo de correos electrónicos para auditar solo el dominio
La pierna de auditoría y la pierna de dirección se ejecutan en paralelo y fallan de manera independiente si un motor no se puede alcanzar los resultados de la otra pierna aún se devuelven con un error nombrado en el bloque de la pierna fallida