SPF, DKIM, and DMARC checker API
Check any domain's mail authentication in one call: MX, SPF policy and lookup count, DMARC policy, DKIM selectors, and BIMI, with a letter grade and the fixes to make.
1 credit per check · $4.95 per 1,000 on Starter, $2.00 on Volume. Always billed.
Request
{
"domain": "northwind.io"
}Response review
{
"verdict": {
"status": "weak",
"reason": "grade_c"
},
"risk": {
"score": 35,
"level": "medium"
},
"details": {
"grade": "C",
"spf": {
"policy": "softfail",
"dns_lookups": 4
},
"dmarc": {
"policy": "none"
},
"dkim": {
"selectors_found": [
"google"
]
}
},
"recommendation": {
"action": "review",
"message": "Fix: dmarc not enforced, …"
}
}What you get back
Every response has a verdict, a risk score, and a recommended action. These are the fields specific to this check; the API reference lists them all.
- grade
- A (fully set up) to F
- spf
- Record, policy (fail, softfail, neutral, pass), and DNS lookup count
- dmarc
- Policy, subdomain policy, pct, and report address
- dkim
- Which common selectors publish a key
- bimi
- Brand logo record
- mx
- Mail servers
What it checks
- MX records
- SPF policy and the 10-lookup limit
- DMARC policy, pct, and reporting
- 21 common DKIM selectors
- BIMI record
- A–F grade with fixes
Try it in a minute
curl https://api.validationcheck.net/v1/domain/email-auth \
-H "Authorization: Bearer $VC_KEY" \
-H "Content-Type: application/json" \
-d '{"domain":"northwind.io"}'const res = await fetch("https://api.validationcheck.net/v1/domain/email-auth", {
method: "POST",
headers: {
Authorization: `Bearer ${process.env.VC_KEY}`,
"Content-Type": "application/json",
},
body: JSON.stringify({
"domain": "northwind.io"
}),
});
const { data } = await res.json();
console.log(data.recommendation.action);import os, requests
res = requests.post(
"https://api.validationcheck.net/v1/domain/email-auth",
headers={"Authorization": f"Bearer {os.environ['VC_KEY']}"},
json={
"domain": "northwind.io"
},
timeout=15,
)
print(res.json()["data"]["recommendation"]["action"])Use a free test key to get documented answers without spending credits.
Where teams use it
Deliverability audits
Show prospects exactly what to fix.
Vendor risk
Domains without DMARC are easy to spoof.
Onboarding checks
Confirm a customer's sending domain before their first campaign.
Questions
Can you find every DKIM selector?
Selectors aren't listed in DNS, so we check the 21 most common ones. A custom selector won't be found.
Pairs well with
{
"status": "valid",
"reason": "mailbox_exists",
"smtp_check": "deliverable",
"is_disposable": false,
"is_role": false,
"action": "approve"
}Email validation
Know if an inbox is real before you send to it.
- Mailbox exists (SMTP)
- Disposable and burner domains
- Role inboxes like info@ and sales@
- Typo fixes: gmial.com → gmail.com
{
"status": "valid",
"reason": "carrier_confirmed",
"e164": "+14155552671",
"line_type": "mobile",
"ported": false,
"action": "approve"
}Phone validation
Valid, reachable, and what kind of line it is.
- Valid and possible, in 240+ regions
- Mobile, landline, VoIP, toll-free
- Carrier and porting (US/CA)
- E.164, national, and international formats
{
"status": "risky",
"reason": "tor_exit",
"connection_type": "datacenter",
"action": "block"
}IP intelligence
Where a visitor is, and whether they're hiding it.
- Country, region, city, time zone
- ASN, network, and ISP
- VPN, proxy, and Tor detection
- AWS, Google Cloud, Cloudflare, Oracle ranges
Get started in 60 seconds
50 free trial credits. Free test keys. No card needed.