{
"scope": "DomainTrust Audit joins two checks, each with a stated limit. The audit leg verifies, from public DNS records, whether the domain publishes MX, SPF and DMARC (with its policy), and whether DKIM records exist under 12 common selectors; it returns a configuration-completeness score (0-100) and an issues list. It does not measure inbox deliverability, sender reputation, or whether mail is actually signed, and a DKIM 'not found' means only that none of the 12 common selectors holds a record. Two readings to know: a null MX record (RFC 7505, 'this domain accepts no mail') currently counts as MX present and raises no issue, and a DKIM selector holding an empty or revoked key counts as found - 'found' means a DKIM-shaped record exists there, not that the key is usable. The email leg screens addresses at domain level only (syntax, domain and MX existence, disposable signals, domain age) - it does not probe whether a mailbox exists, and its catch-all field is a risk signal inferred from MX/provider patterns, never a probed conclusion. Flagged addresses are grouped by whether their domain is the audited domain; that grouping is shown so configuration findings and address findings can be read side by side - it is a grouping, not proof of what caused any single flag.",
"domain": "example.com",
"audit": {
"domain": "example.com",
"score": 98,
"grade": "A",
"checks": {
"mx": {
"present": true,
"records": [
"0 ."
]
},
"spf": {
"present": true,
"records": [
"v=spf1 -all"
]
},
"dmarc": {
"present": true,
"records": [
"v=DMARC1;p=reject;sp=reject;adkim=s;aspf=s"
],
"policy": "reject"
},
"dkim": {
"commonSelectorFound": true,
"selectorsFound": [
"selector1",
"selector2",
"dkim",
"default",
"mail",
"google",
"s1",
"k1",
"s2",
"k2",
"smtp",
"mandrill"
],
"selectorsChecked": [
"default",
"google",
"selector1",
"selector2",
"mail",
"dkim",
"s1",
"s2",
"k1",
"k2",
"mandrill",
"smtp"
],
"coverageNote": "Only the common selectors listed in selectorsChecked are probed. Domains that sign with a custom selector (common for large senders — e.g. Google signs with date-based selectors such as 20230601) are NOT detected by this check, so a 'not found' result here does not prove DKIM is missing or that mail is unsigned."
}
},
"issues": [
{
"severity": "info",
"check": "dmarc",
"message": "DMARC record has no rua= reporting address — you will not receive aggregate reports."
}
],
"source": "DNS-over-HTTPS (Cloudflare)"
},
"emails": {
"results": [
{
"email": "[email protected]",
"valid": true,
"score": 100,
"verdict": "valid",
"checks": {
"syntax": true,
"domainExists": true,
"mxFound": true,
"disposable": false,
"roleAccount": false,
"freeProvider": false
},
"mxRecords": [],
"suggestion": null,
"typoLikely": false,
"domainAgeDays": 11410,
"domainAgeSource": "RDAP",
"catchAllRisk": "unknown",
"note": "Checks domain mail routing (MX) and risk signals. Does not probe individual mailbox existence. Catch-all risk is a risk signal based on MX/provider patterns, not a probing conclusion."
},
{
"email": "[email protected]",
"valid": true,
"score": 100,
"verdict": "valid",
"checks": {
"syntax": true,
"domainExists": true,
"mxFound": true,
"disposable": false,
"roleAccount": false,
"freeProvider": false
},
"mxRecords": [],
"suggestion": null,
"typoLikely": false,
"domainAgeDays": 11410,
"domainAgeSource": "RDAP",
"catchAllRisk": "unknown",
"note": "Checks domain mail routing (MX) and risk signals. Does not probe individual mailbox existence. Catch-all risk is a risk signal based on MX/provider patterns, not a probing conclusion."
}
],
"summary": {
"total": 2,
"valid": {
"count": 2,
"percent": 100
},
"risky": {
"count": 0,
"percent": 0
},
"invalid": {
"count": 0,
"percent": 0
},
"disposable": {
"count": 0,
"percent": 0
},
"typoLikely": {
"count": 0,
"percent": 0
}
}
},
"summary": {
"audit": {
"score": 98,
"grade": "A",
"issueCount": 1,
"issuesBySeverity": {
"error": 0,
"warning": 0,
"info": 1
}
},
"addresses": {
"total": 2,
"valid": 2,
"risky": 0,
"invalid": 0,
"disposable": 0,
"typoLikely": 0
},
"flagged": {
"total": 0,
"domainContext": {
"count": 0,
"byVerdict": {
"risky": 0,
"invalid": 0
},
"addresses": []
},
"addressLevel": {
"count": 0,
"byVerdict": {
"risky": 0,
"invalid": 0
},
"addresses": []
},
"note": "Flagged = the email leg's risky + invalid verdicts, grouped by whether the address's domain is the audited domain. Addresses grouped under domainContext sit next to the domain's own configuration findings in the audit block above; addressLevel flags rest on the address's own signals (listed per address) or on a different domain. Grouping only - it does not prove what caused any single flag."
}
}
}
curl --location --request POST 'https://zylalabs.com/api/14803/domaintrust+audit+api/38381/audit+domain' --header 'Authorization: Bearer YOUR_API_KEY'
--data-raw '{"domain": "example.com", "emails": ["[email protected]", "[email protected]"]}'
{
"ok": true,
"service": "DomainTrust Audit",
"version": 1
}
curl --location --request GET 'https://zylalabs.com/api/14803/domaintrust+audit+api/38382/health+check' --header 'Authorization: Bearer YOUR_API_KEY'
注册后,每个开发者都会被分配一个个人 API 访问密钥,这是一个唯一的字母和数字组合,用于访问我们的 API 端点。要使用 域信任审计 API 进行身份验证,只需在 Authorization 标头中包含您的 bearer token。
| 标头 | 描述 |
|---|---|
授权
|
必需
应为 Bearer access_key. 订阅后,请查看上方的"您的 API 访问密钥"。
|
不 评分计算配置完整性 - 哪些 MX SPF DMARC 和 DKIM-共用选择器已发布 以及记录的设置方式 投递依赖于发件人声誉 内容和接收者策略 这些 API 并未读取或声称读取
不这意味着12个常见选择器中没有一个持有记录使用自定义选择器的域名(对于大型发送者来说很常见)不会被此检查检测到且响应的覆盖注释也这么说
不 它检查域邮件路由(MX) 注册数据和域级的风险信号 邮箱级的探测是不可靠的 所以我们不这样做也不声称这样做
是的 一个调用可以获取一个域名,并且可以选择最多100个地址 省略电子邮件字段仅审计该域名
审计路径和地址路径并行运行并独立失败:如果一个引擎不可访问,另一条路径的结果仍然会返回,同时在失败路径的块中会有一个命名错误