{
"scope": "DomainTrust Audit joins two checks, each with a stated limit. The audit leg verifies, from public DNS records, whether the domain publishes MX, SPF and DMARC (with its policy), and whether DKIM records exist under 12 common selectors; it returns a configuration-completeness score (0-100) and an issues list. It does not measure inbox deliverability, sender reputation, or whether mail is actually signed, and a DKIM 'not found' means only that none of the 12 common selectors holds a record. Two readings to know: a null MX record (RFC 7505, 'this domain accepts no mail') currently counts as MX present and raises no issue, and a DKIM selector holding an empty or revoked key counts as found - 'found' means a DKIM-shaped record exists there, not that the key is usable. The email leg screens addresses at domain level only (syntax, domain and MX existence, disposable signals, domain age) - it does not probe whether a mailbox exists, and its catch-all field is a risk signal inferred from MX/provider patterns, never a probed conclusion. Flagged addresses are grouped by whether their domain is the audited domain; that grouping is shown so configuration findings and address findings can be read side by side - it is a grouping, not proof of what caused any single flag.",
"domain": "example.com",
"audit": {
"domain": "example.com",
"score": 98,
"grade": "A",
"checks": {
"mx": {
"present": true,
"records": [
"0 ."
]
},
"spf": {
"present": true,
"records": [
"v=spf1 -all"
]
},
"dmarc": {
"present": true,
"records": [
"v=DMARC1;p=reject;sp=reject;adkim=s;aspf=s"
],
"policy": "reject"
},
"dkim": {
"commonSelectorFound": true,
"selectorsFound": [
"selector1",
"selector2",
"dkim",
"default",
"mail",
"google",
"s1",
"k1",
"s2",
"k2",
"smtp",
"mandrill"
],
"selectorsChecked": [
"default",
"google",
"selector1",
"selector2",
"mail",
"dkim",
"s1",
"s2",
"k1",
"k2",
"mandrill",
"smtp"
],
"coverageNote": "Only the common selectors listed in selectorsChecked are probed. Domains that sign with a custom selector (common for large senders — e.g. Google signs with date-based selectors such as 20230601) are NOT detected by this check, so a 'not found' result here does not prove DKIM is missing or that mail is unsigned."
}
},
"issues": [
{
"severity": "info",
"check": "dmarc",
"message": "DMARC record has no rua= reporting address — you will not receive aggregate reports."
}
],
"source": "DNS-over-HTTPS (Cloudflare)"
},
"emails": {
"results": [
{
"email": "[email protected]",
"valid": true,
"score": 100,
"verdict": "valid",
"checks": {
"syntax": true,
"domainExists": true,
"mxFound": true,
"disposable": false,
"roleAccount": false,
"freeProvider": false
},
"mxRecords": [],
"suggestion": null,
"typoLikely": false,
"domainAgeDays": 11410,
"domainAgeSource": "RDAP",
"catchAllRisk": "unknown",
"note": "Checks domain mail routing (MX) and risk signals. Does not probe individual mailbox existence. Catch-all risk is a risk signal based on MX/provider patterns, not a probing conclusion."
},
{
"email": "[email protected]",
"valid": true,
"score": 100,
"verdict": "valid",
"checks": {
"syntax": true,
"domainExists": true,
"mxFound": true,
"disposable": false,
"roleAccount": false,
"freeProvider": false
},
"mxRecords": [],
"suggestion": null,
"typoLikely": false,
"domainAgeDays": 11410,
"domainAgeSource": "RDAP",
"catchAllRisk": "unknown",
"note": "Checks domain mail routing (MX) and risk signals. Does not probe individual mailbox existence. Catch-all risk is a risk signal based on MX/provider patterns, not a probing conclusion."
}
],
"summary": {
"total": 2,
"valid": {
"count": 2,
"percent": 100
},
"risky": {
"count": 0,
"percent": 0
},
"invalid": {
"count": 0,
"percent": 0
},
"disposable": {
"count": 0,
"percent": 0
},
"typoLikely": {
"count": 0,
"percent": 0
}
}
},
"summary": {
"audit": {
"score": 98,
"grade": "A",
"issueCount": 1,
"issuesBySeverity": {
"error": 0,
"warning": 0,
"info": 1
}
},
"addresses": {
"total": 2,
"valid": 2,
"risky": 0,
"invalid": 0,
"disposable": 0,
"typoLikely": 0
},
"flagged": {
"total": 0,
"domainContext": {
"count": 0,
"byVerdict": {
"risky": 0,
"invalid": 0
},
"addresses": []
},
"addressLevel": {
"count": 0,
"byVerdict": {
"risky": 0,
"invalid": 0
},
"addresses": []
},
"note": "Flagged = the email leg's risky + invalid verdicts, grouped by whether the address's domain is the audited domain. Addresses grouped under domainContext sit next to the domain's own configuration findings in the audit block above; addressLevel flags rest on the address's own signals (listed per address) or on a different domain. Grouping only - it does not prove what caused any single flag."
}
}
}
curl --location --request POST 'https://zylalabs.com/api/14803/domaintrust+audit+api/38381/audit+domain' --header 'Authorization: Bearer YOUR_API_KEY'
--data-raw '{"domain": "example.com", "emails": ["[email protected]", "[email protected]"]}'
{
"ok": true,
"service": "DomainTrust Audit",
"version": 1
}
curl --location --request GET 'https://zylalabs.com/api/14803/domaintrust+audit+api/38382/health+check' --header 'Authorization: Bearer YOUR_API_KEY'
Após se cadastrar, cada desenvolvedor recebe uma chave de acesso à API pessoal, uma combinação única de letras e dígitos para acessar nosso endpoint de API. Para autenticar com a Auditoria de Confiança de Domínio API basta incluir seu token Bearer no cabeçalho Authorization.
| Cabeçalho | Descrição |
|---|---|
Authorization
|
Obrigatório
Deve ser Bearer access_key. Veja "Sua chave de acesso à API" acima quando você estiver inscrito.
|
Sem compromisso de longo prazo. Faça upgrade, downgrade ou cancele a qualquer momento.
API de auditoria de autenticação de e-mail de domínio: verificações de MX, SPF, DMARC e seletor DKIM a partir do DNS público, uma pontuação de completude de configuração de 0 a 100, além de triagem de endereços
Não A pontuação conta a completude da configuração — quais dos MX SPF DMARC e DKIM sob seletores comuns estão publicados e como os registros estão configurados A entrega depende da reputação do remetente do conteúdo e da política do receptor nenhum dos quais esta API lê ou afirma ler
Não Isso significa que nenhum dos 12 seletores comuns possui um registro Domínios que assinam com um seletor personalizado (comum para grandes remetentes) não são detectados por essa verificação e a nota de cobertura da resposta diz isso
Não Verifica o roteamento de e-mail de domínio (MX) dados de registro e sinais de risco a nível de domínio O teste a nível de caixa de entrada é pouco confiável então não o fazemos e não afirmamos isso
Sim Uma chamada leva exatamente um domínio e, opcionalmente, até 100 endereços Omitir o campo de emails para auditar apenas o domínio
A perna de auditoria e a perna de endereço funcionam em paralelo e falham independentemente se um motor não estiver acessível os resultados da outra perna ainda são retornados com um erro nomeado no bloco da perna que falhou