The Email Authentication Check API grades a domain's SPF, DKIM and DMARC setup
Send a domain and get its MX, SPF, DMARC, DKIM and BIMI read from public DNS, a 0 to 100 grade, whether it can be spoofed and an ordered list of fixes. 2 credits, and nothing for a domain that does not exist.
2
Credits per domain
about $0.01 on Starter
5
Records read and graded
MX, SPF, DMARC, DKIM, BIMI
20
DKIM selector names checked
with the key size on each
0
Credits for a missing domain
or when DNS does not answer
What Email Authentication Check gives you
SPF is counted through every include
A receiving server ignores an SPF record that needs more than 10 DNS lookups. The API follows every include and redirect, returns the count beside the limit and catches the errors that silently break a record.
- dns_lookup_count against the limit of 10
- Two SPF records, +all and unknown terms flagged
- An include with no SPF record behind it
- Include loops detected
DMARC is read the way a receiver applies it
The policy, the share of mail it covers, where reports go and what happens on subdomains. A subdomain with no record of its own shows the policy it inherits from its parent domain.
- Policy: none, quarantine or reject
- pct, rua and ruf addresses
- Subdomain policy and alignment
- inherited_from for subdomains
DKIM keys are found and measured on 20 common selector names
Each key found on the names most mail systems use comes back with its type and size, so a 1024-bit key is flagged for replacement. A key under a custom name is reported honestly as not found on the common names.
- 20 selector names checked
- Key type and size in bits
- Testing mode flagged
- dkim.complete says whether the check finished
The mail provider is named, not just the servers
MX records come back in priority order with the mailbox provider and any security gateway identified from the host names, and a null MX is recognized as a deliberate setup.
- Google Workspace, Microsoft 365 and more
- Security gateway in front of the mailbox
- MX hosts in priority order
- Null MX recognized
A grade, a spoofing verdict and the fixes in order
DMARC, SPF, DKIM, MX and BIMI are weighted into one 0 to 100 grade with a letter. The fixes come as plain one-sentence instructions, most important first, so the next step is never a guess.
- 0 to 100 grade and a letter
- can_be_spoofed as true or false
- Ordered list of plain fixes
- A recommended action in the response
A timeout is never billed or read as a missing record
A domain that does not exist costs 0 credits, and so does a lookup where DNS did not answer. A record that is missing is reported as missing only when DNS actually said so.
- 0 credits for a domain that does not exist
- 0 credits when DNS does not answer
- Bulk CSV with a domain column
- The same credits as every other product
A domain goes in and a graded setup comes out
Send a domain, an email address or a URL
POST any of the three and it is reduced to the domain. A subdomain is kept as written, because a sending subdomain can publish its own SPF and DMARC records.
$ POST /api/v1/email-auth-check
"domain": "stripe.com"
> or an email address, or a URL
We read the domain's public DNS
The same questions a receiving mail server asks: MX, SPF counted through every include, DMARC, DKIM keys on 20 common selector names and BIMI. DNS that does not answer is reported as a failure, never as a missing record.
MX records and provider read
SPF counted through every include
DMARC policy and DKIM keys read
Grade and fixes computed
Get a grade, a spoofing answer and the fixes
A 0 to 100 grade with a letter, can_be_spoofed as a true or false, the findings for each record and the fixes in order. A domain that exists bills 2 credits, and one that does not bills nothing.
grade87, B
dmarcreject, 100%
spf7 of 10 lookups
One endpoint. A domain, an email address or a URL in, structured data out.
Same authentication, same credit balance, and the same response envelope as every other 1Lookup product. If you have already integrated one endpoint, this one is a URL change.
curl -X POST https://app.1lookup.io/api/v1/email-auth-check \
-H "Authorization: Bearer $API_KEY" \
-H "Content-Type: application/json" \
-d '{ "domain": "stripe.com" }'{
"classification": {
"found": true,
"domain_exists": true,
"domain": "stripe.com",
"grade": 87,
"grade_letter": "B",
"can_be_spoofed": false,
"accepts_mail": true,
"mail_provider": "Google Workspace",
"has_spf": true,
"spf_valid": true,
"has_dmarc": true,
"dmarc_policy": "reject",
"has_dkim": true,
"has_bimi": false,
"fix_count": 3
},
"insights": {
"email_auth_result": {
"spf": {
"valid": true,
"all_qualifier": "~all",
"dns_lookup_count": 7,
"dns_lookup_limit": 10,
"exceeds_lookup_limit": false
},
"dmarc": {
"valid": true,
"policy": "reject",
"pct": 100,
"rua": ["dmarc-reports@stripe.com"]
},
"dkim": {
"found": true,
"selectors": [
{ "selector": "google", "key_type": "rsa", "key_bits": 1024 }
],
"selectors_checked": 20
},
"bimi": { "valid": false },
"fixes": [
"Replace the 1024-bit DKIM key on selector \"google\" with a 2048-bit key, which is the current standard.",
"Change ~all to -all in your SPF record once every sender is listed, so unlisted servers are rejected instead of only flagged.",
"Optional: publish a BIMI record at default._bimi.stripe.com so supporting inboxes show your logo next to your mail."
],
"data_source": "dns"
}
},
"metadata": { "credits_used": 2, "cache_hit": false }
}One call grades all five email records and lists the fixes
A domain goes in and a graded setup comes out: what each record says, whether the domain can be spoofed and what to change first, with the raw JSON your code receives beside it.
- Domainstripe.com
- Grade87 of 100, B
- Can be spoofedNo
- Mail providerGoogle Workspace
- DMARC policyreject, 100% of mail
- SPF DNS lookups7 of 10 used
- SPF ending~all (soft fail)
- DKIMgoogle selector, 1024-bit key
- BIMI logo recordNot published
- Selector names checked20
- Fixes listed3
{
"classification": {
"domain": "stripe.com",
"grade": 87,
"grade_letter": "B",
"can_be_spoofed": false,
"mail_provider": "Google Workspace",
"dmarc_policy": "reject",
"has_spf": true,
"has_dkim": true,
"has_bimi": false,
"fix_count": 3
},
"insights": {
"email_auth_result": {
"spf": {
"dns_lookup_count": 7,
"dns_lookup_limit": 10
},
"fixes": [
"Replace the 1024-bit DKIM key on selector \"google\" with a 2048-bit key..."
]
}
},
"metadata": { "credits_used": 2 }
}Every field you get back
No hidden tiers. Every field below is returned on a successful lookup at the price shown above.
Verdict
- grade
- grade_letter
- can_be_spoofed
- fix_count
- fixes[]
- domain_exists
Mail servers
- mx.records[]
- mx.provider
- mx.gateway
- mx.accepts_mail
- mx.null_mx
SPF
- spf.record
- spf.valid
- spf.all_qualifier
- spf.dns_lookup_count
- spf.dns_lookup_limit
- spf.exceeds_lookup_limit
- spf.errors[]
DMARC
- dmarc.policy
- dmarc.pct
- dmarc.rua[]
- dmarc.ruf[]
- dmarc.subdomain_policy
- dmarc.inherited_from
DKIM and BIMI
- dkim.selectors[]
- dkim.selectors[].key_bits
- dkim.complete
- bimi.record
- bimi.logo_url
- bimi.vmc_url
Who uses Email Authentication Check
Email marketers and cold-email teams checking a sending domain
Before a campaign goes out, check the domain you send from. A missing DMARC record, an SPF record over the 10-lookup limit or a 1024-bit DKIM key shows up as a fix instead of as a drop in deliverability a month later.
Deliverability consultants and agencies onboarding a client
Run every domain a client sends from in one bulk job and hand back a graded list with the fixes in order. Run it again the next week to see which ones were fixed.
MSPs and IT admins managing many domains
Upload a CSV of customer domains and sort by grade to find the ones where anyone can send as the domain. Re-run it weekly to catch a DMARC or SPF record that someone broke while editing DNS.
Security teams assessing their own and their vendors' domains
Use can_be_spoofed as a one-line screen across a vendor list. A domain on a DMARC policy of none or with no DMARC at all is open to impersonation, which is the first thing a phishing attempt checks.
Sales teams researching a prospect's email stack
The mail provider and the security gateway tell you whether a prospect runs Google Workspace, Microsoft 365 or a gateway in front of it, before the first call.
Developers building email tools
Add a domain health check to an onboarding flow with one call. Show the grade and the fixes the moment a customer connects a sending domain, instead of building a DNS parser.
Frequently asked questions
What does the Email Authentication Check API return?
Send a domain and it returns one graded result: the mail servers (MX) and the mail provider behind them, the SPF record with its DNS lookups counted against the limit of 10, the DMARC policy with its pct and reporting address, the DKIM keys found on 20 common selectors with their key size, the BIMI record, a 0 to 100 grade with a letter, whether the domain can be spoofed, and an ordered list of plain fixes.
Where does the data come from?
From public DNS only. Every fact is a record the domain owner published, and the API asks the same questions a receiving mail server asks. There is no data broker and no third-party database in between, which is why a check costs 2 credits.
How is the 0 to 100 grade calculated?
DMARC carries 40 points, SPF 30, DKIM 15, MX 10 and BIMI 5. A DMARC policy of reject scores highest, then quarantine, then none, scaled by the pct value and with a bonus for a reporting address. A letter follows: A at 90 and above, B at 80, C at 65, D at 50 and F below that. The fixes list says which change earns the most points.
What does can_be_spoofed mean?
It is true unless DMARC is published, valid, set to quarantine or reject, and applied to 100 percent of mail. A DMARC policy of none only monitors, so a domain on none can still be impersonated. It is the one-line answer to whether anyone can send mail that looks like it came from this domain.
What is the SPF 10-lookup limit, and does the API count it?
A receiving server ignores an SPF record that needs more than 10 DNS lookups to evaluate, so every include and redirect counts. The API follows every include and redirect, returns the count next to the limit, and flags a record that goes over, a record with two SPF entries, a +all ending, an include with no SPF record behind it and an include loop.
Why does DKIM say no key was found for a domain that signs its mail?
DKIM keys live under a selector name that the sender chooses, and there is no way to list them. The API checks the 20 names most mail systems use, including google, selector1, selector2, k1 to k3, default, s1, s2, mail, dkim, mandrill, smtp, zoho and protonmail, and measures the key size on each one it finds. A key published under a custom name will not show up, and the result says so rather than claiming DKIM is missing.
How much does an email authentication check cost?
2 credits per domain, which is about $0.01 on the Starter plan and about $0.007 on Growth. You are charged when the domain exists in DNS. A domain that does not exist costs 0 credits, and so does a lookup where DNS did not answer, so a timeout is never read as a missing record or billed.
Can I check a list of domains?
Yes. Upload a CSV with a domain column and you get a row per domain with the grade, the letter, whether it can be spoofed, the mail provider, whether SPF, DMARC, DKIM and BIMI are present and the number of fixes. The price stays at 2 credits per domain, however long the list is.
Can I run it on a schedule to catch a broken record?
You can run the same check every week on your sending domains, from your own scheduler or by uploading the same CSV again, and compare the grade and the fixes with the week before. DNS records get broken quietly: someone edits DNS, adds a second SPF record or drops the DMARC line, and mail lands in spam weeks before anyone looks. Results are cached for 7 days, so send bypass_cache: true after you change a record.
What if I send an email address or a URL instead of a domain?
It is reduced to its domain. A subdomain such as news.example.com is checked as written, because a sending subdomain can publish its own SPF and DMARC records. When a subdomain has no DMARC record of its own, the result shows the policy it inherits from its parent domain, the way a receiving server would apply it.
To check one record on one domain before you write any code, use the free DMARC checker, the free SPF checker, the free DKIM checker and the free MX record lookup.