Email Authentication Check API

Audit a domain’s email setup: MX, SPF (with the 10-lookup limit), DKIM keys, DMARC policy, MTA-STS, TLS-RPT and BIMI, with a score and what to fix.

GEThttps://apibox.io.vn/v1/email-auth

Network & Validation▶ Try it online

The email authentication API checks whether a domain is set up to deliver email and to resist spoofing, the requirements Gmail, Yahoo and Outlook now enforce for bulk senders. It reads the MX records, the SPF record (detecting duplicates, +all / ?all, deprecated ptr and counting the DNS lookups through every include against the limit of 10), DKIM keys at your selectors or at about 20 common ones (Google, Microsoft 365, Mailchimp, SendGrid, Resend, Zoho…), with their key size, and the DMARC policy with its reporting addresses.

Optional records are reported too: MTA-STS and TLS-RPT for encrypted delivery and BIMI for a brand logo in the inbox. Every finding is a check with a status (pass, info, warn, fail) and a message in English or Vietnamese (lang=vi) that says what to change; the score from 0 to 100 and the A–F grade give a quick overview.

DKIM selectors are not discoverable in DNS: if your provider uses a custom one, read the s= tag of the DKIM-Signature header of a sent email and pass it as selectors=. Records are read live through DNS-over-HTTPS (cached for 5 minutes).

Parameters

Name	In	Type	Required	Default
`domain`	query	string	yes		Domain (or an email address).
`selectors`	query	string	no		DKIM selectors to check, comma-separated (default: ~20 common ones).
`lang`	query	string	no	`en`	Language of the messages: `en` or `vi`.

Example

curl "https://apibox.io.vn/v1/email-auth?domain=github.com" \
  -H "Authorization: Bearer YOUR_API_KEY"

const res = await fetch('https://apibox.io.vn/v1/email-auth?domain=github.com', {
  method: 'GET',
  headers: {
    Authorization: 'Bearer YOUR_API_KEY',
  },
});
const data = await res.json();
console.log(data);

import requests

res = requests.get(
    "https://apibox.io.vn/v1/email-auth?domain=github.com",
    headers={"Authorization": "Bearer YOUR_API_KEY"},
    timeout=30,
)
print(res.json())

<?php
$ch = curl_init('https://apibox.io.vn/v1/email-auth?domain=github.com');
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => ['Authorization: Bearer YOUR_API_KEY'],
]);
$response = curl_exec($ch);
print_r(json_decode($response, true));

Response

{
  "domain": "github.com",
  "score": 90,
  "grade": "A",
  "summary": {
    "passed": 5,
    "info": 3,
    "warnings": 2,
    "errors": 0
  },
  "mx": [
    {
      "preference": 1,
      "host": "aspmx.l.google.com"
    }
  ],
  "spf": {
    "record": "v=spf1 ip4:192.30.252.0/22 include:spf.protection.outlook.com … ~all",
    "all": "softfail",
    "dns_lookups": 10,
    "includes": [
      "spf.protection.outlook.com",
      "_netblocks.google.com",
      "…"
    ]
  },
  "dmarc": {
    "record": "v=DMARC1; p=quarantine; …",
    "p": "quarantine"
  },
  "dkim": [
    {
      "selector": "google",
      "key_type": "rsa",
      "key_bits": 2048,
      "revoked": false,
      "testing": false
    },
    {
      "selector": "selector1",
      "key_type": "rsa",
      "key_bits": 1024,
      "revoked": false,
      "testing": false
    }
  ],
  "checks": [
    {
      "id": "spf_lookups",
      "status": "warn",
      "message": "10/10 DNS lookups",
      "value": 10
    },
    {
      "id": "dmarc",
      "status": "pass",
      "message": "DMARC policy \"p=quarantine\""
    },
    {
      "id": "dkim_key",
      "status": "warn",
      "message": "RSA key shorter than 2048 bits at selector1, k1"
    },
    "…"
  ]
}

Use cases

Onboarding checks in email-sending and CRM products
Fix “sent to spam” problems before a campaign
Monitor client domains in agencies and MSPs
Verify DNS changes after moving email providers

FAQ

Why does SPF fail with too many lookups?

RFC 7208 allows at most 10 DNS lookups (include, a, mx, ptr, exists, redirect) to evaluate SPF; beyond that receivers return permerror and SPF fails. The API counts them recursively; remove unused includes or flatten them.

Is p=none enough?

It satisfies the minimum requirement of Gmail and Yahoo but does not stop spoofing. Read the reports (rua=) and move to p=quarantine or p=reject.

The DKIM check says nothing was found, but I sign my email.

Your provider probably uses a custom selector. Find the s= value in the DKIM-Signature header of a received email and pass selectors=that-value.

Email Authentication Check API

Parameters

Example

Response

Use cases

FAQ

Related APIs

IP Geolocation

DNS Lookup

Email Validator