Name: Email Domain Intelligence API | SPF, DMARC, DKIM & MX
Brand: api-factory-1
SKU: api-api-factory-1-email-domain-intelligence
Availability: InStock
Author: API Market

David Garcia

# Email Domain Intelligence and Authentication API

## Overview

The Email Domain Intelligence and Authentication API inspects a domain's public email DNS configuration in a single request. It checks MX routing, SPF, DMARC, DKIM (for a selector you supply), MTA-STS, TLS-RPT, BIMI and DNSSEC, infers the email provider when the MX evidence is strong, and returns a 0 to 100 configuration health score with a grade, per-check reasons, warnings and recommendations. A second endpoint checks a single DKIM selector on its own.

It is built for SaaS teams validating customer domains during onboarding, IT and security teams auditing email authentication, deliverability and DevOps engineers checking configuration after a migration, and anyone who wants structured JSON instead of running dig by hand. The API reads public DNS only: it does not contact mailboxes, send email or predict inbox placement.

## Features

*   **Two endpoints**: `/v1/domain` for the full domain analysis and `/v1/dkim` for a single DKIM selector check.
*   **Full email DNS coverage**: MX, null MX, SPF, DMARC, DKIM, MTA-STS DNS, TLS-RPT, BIMI and DNSSEC in one response.
*   **Health score and grade**: A 0 to 100 configuration score with a letter grade and the points earned for each check.
*   **Warnings and recommendations**: Structured warnings with severity, plus concrete recommendations for missing or weak records.
*   **Provider inference**: Identifies providers such as Microsoft 365 from MX evidence, with a confidence level.
*   **Lookup status per check**: Each check reports `lookup_status`, so a failed lookup is never confused with a missing record.

## Use Cases

*   **SaaS onboarding**: Confirm a customer's sending domain has SPF, DMARC and DKIM before enabling email features.
*   **Admin dashboards**: Show MX, SPF and DMARC status for every domain you manage.
*   **Security audits**: Find domains with permissive SPF, missing DMARC enforcement or no DNSSEC.
*   **Email platform migrations**: Verify the new DKIM selector is published and the old one is removed.
*   **Domain inventory enrichment**: Add provider and authentication signals to a list of domains.

## API Documentation

### Base URL

All requests go through the API.market gateway at this base URL:

```
https://prod.api.market/api/v1/api-factory-1/email-domain-intelligence
```

### Authentication

Every request needs your API.market key in the `x-api-market-key` header:

```
x-api-market-key: YOUR_API_KEY
```

Replace `YOUR_API_KEY` with your actual API key.

### Endpoints

#### 1. Analyze a Domain

Returns the full email DNS analysis for a domain: provider, MX, SPF, DMARC, DKIM (when you pass `dkim_selector`), MTA-STS, TLS-RPT, BIMI, DNSSEC, the health score and request metadata. Check `data.meta.partial` and each check's `lookup_status` before treating a missing signal as a missing record.

**Method:** `GET`

**Endpoint:** `/v1/domain`

**Parameters:**

| Name | In | Description | Type | Required | Default | Max Value |
|---|---|---|---|---|---|---|
| domain | query | Bare public domain name, for example `github.com`. No email address, URL or path. | string | Yes | - | 254 chars |
| dkim_selector | query | DKIM selector to check as part of the analysis, for example `selector1`. Without it, DKIM is reported as `selector_required` and left out of the score. | string | No | - | - |

**Example Request:**

```bash
curl -X GET "https://prod.api.market/api/v1/api-factory-1/email-domain-intelligence/v1/domain?domain=github.com" \
  -H "x-api-market-key: YOUR_API_KEY"
```

**Example Response (200 OK, abridged):**

```json
{
  "data": {
    "domain": "github.com",
    "domain_status": "active",
    "email_capable": true,
    "provider": {
      "name": "Microsoft 365",
      "confidence": "high",
      "evidence": [
        "github-com.mail.protection.outlook.com"
      ]
    },
    "mx": {
      "configured": true,
      "lookup_status": "ok",
      "records": [
        {
          "priority": 0,
          "host": "github-com.mail.protection.outlook.com",
          "ttl": 57
        }
      ],
      "null_mx": false,
      "warnings": []
    },
    "spf": {
      "configured": true,
      "lookup_status": "ok",
      "record": "v=spf1 ip4:192.30.252.0/22 include:spf.protection.outlook.com include:_netblocks.google.com include:_netblocks2.google.com include:mail.zendesk.com include:_spf.salesforce.com include:servers.mcsv.net include:mktomail.co...",
      "records": [
        "v=spf1 ip4:192.30.252.0/22 include:spf.protection.outlook.com include:_netblocks.google.com include:_netblocks2.google.com include:mail.zendesk.com include:_spf.salesforce.com include:servers.mcsv.net include:mktomail.co..."
      ],
      "mechanisms": [
        "ip4:192.30.252.0/22",
        "include:spf.protection.outlook.com"
      ],
      "includes": [
        "spf.protection.outlook.com",
        "_netblocks.google.com"
      ],
      "all_policy": "softfail",
      "warnings": []
    },
    "dmarc": {
      "configured": true,
      "lookup_status": "ok",
      "record": "v=DMARC1; p=quarantine; sp=reject; pct=100; rua=mailto:dmarc@github.com; ruf=mailto:dmarc@github.com; fo=1",
      "records": [
        "v=DMARC1; p=quarantine; sp=reject; pct=100; rua=mailto:dmarc@github.com; ruf=mailto:dmarc@github.com; fo=1"
      ],
      "policy": "quarantine",
      "subdomain_policy": "reject",
      "percentage": 100,
      "rua": [
        "mailto:dmarc@github.com"
      ],
      "ruf": [
        "mailto:dmarc@github.com"
      ],
      "alignment_spf": "relaxed",
      "alignment_dkim": "relaxed",
      "warnings": []
    },
    "dkim": {
      "status": "selector_required",
      "configured": null,
      "lookup_status": "not_queried",
      "explanation": "DKIM selectors cannot be discovered reliably from DNS. Supply dkim_selector or use /v1/dkim.",
      "warnings": []
    },
    "mta_sts": {
      "configured": false,
      "lookup_status": "ok",
      "record": null,
      "id": null,
      "policy_https_checked": false,
      "warnings": [
        {
          "code": "MTA_STS_NOT_CONFIGURED",
          "severity": "low",
          "message": "No MTA-STS DNS record was found.",
          "field": "mta_sts.configured"
        }
      ]
    },
    "tls_rpt": {
      "configured": false,
      "lookup_status": "ok",
      "record": null,
      "reporting_uris": [],
      "warnings": [
        {
          "code": "TLS_RPT_NOT_CONFIGURED",
          "severity": "low",
          "message": "No TLS reporting record was found.",
          "field": "tls_rpt.configured"
        }
      ]
    },
    "bimi": {
      "configured": false,
      "lookup_status": "ok",
      "record": null,
      "logo_location": null,
      "authority_location": null,
      "visual_display_verified": false,
      "warnings": []
    },
    "dnssec": {
      "status": "unknown",
      "lookup_status": "ok",
      "ds_records": [],
      "determination": "secure requires DS records plus resolver AD=true; unsigned requires an authenticated empty DS answer; otherwise unknown",
      "warnings": [
        {
          "code": "DNSSEC_UNKNOWN",
          "severity": "info",
          "message": "The resolver response did not provide enough authenticated evidence to determine DNSSEC status.",
          "field": "dnssec.status"
        }
      ]
    },
    "health": {
      "name": "email_authentication_health_score",
      "score": 69,
      "grade": "D",
      "points": 62,
      "possible": 90,
      "components": [
        {
          "check": "mx",
          "points": 20,
          "possible": 20,
          "reason": "usable MX records found"
        },
        {
          "check": "spf",
          "points": 17,
          "possible": 20,
          "reason": "single SPF record with softfail all policy"
        }
      ],
      "disclaimer": "Configuration health only; not a deliverability or inbox-placement prediction.",
      "warnings": [
        {
          "code": "MTA_STS_NOT_CONFIGURED",
          "severity": "low",
          "message": "No MTA-STS DNS record was found.",
          "field": "mta_sts.configured"
        },
        {
          "code": "TLS_RPT_NOT_CONFIGURED",
          "severity": "low",
          "message": "No TLS reporting record was found.",
          "field": "tls_rpt.configured"
        }
      ],
      "recommendations": [
        {
          "code": "RECOMMEND_MTA_STS_NOT_CONFIGURED",
          "message": "Consider MTA-STS after validating mail-server TLS readiness.",
          "field": "mta_sts.configured"
        },
        {
          "code": "RECOMMEND_TLS_RPT_NOT_CONFIGURED",
          "message": "Consider TLS-RPT to receive transport-security failure reports.",
          "field": "tls_rpt.configured"
        }
      ]
    },
    "meta": {
      "checked_at": "2026-10-06T06:19:07.005Z",
      "dns_provider": "Cloudflare 1.1.1.1 DNS-over-HTTPS JSON",
      "partial": false,
      "lookup_statuses": {
        "mx": "ok",
        "spf": "ok",
        "dmarc": "ok",
        "dkim": "not_queried",
        "mta_sts": "ok",
        "tls_rpt": "ok",
        "bimi": "ok",
        "dnssec": "ok"
      },
      "data_retention": "none",
      "request_id": "9c743674-8a97-4fcc-ba94-587e705878c9"
    }
  },
  "requestId": "9c743674-8a97-4fcc-ba94-587e705878c9"
}
```

#### 2. Check a DKIM Selector

Looks up `<selector>._domainkey.<domain>` and reports whether the record exists, its key type, whether a public key is present, and any warnings. In this example the selector exists but its key has been removed, so the API flags `DKIM_PUBLIC_KEY_MISSING`.

**Method:** `GET`

**Endpoint:** `/v1/dkim`

**Parameters:**

| Name | In | Description | Type | Required | Default | Max Value |
|---|---|---|---|---|---|---|
| domain | query | Bare public domain name, for example `gmail.com`. | string | Yes | - | 254 chars |
| selector | query | DKIM selector to look up, for example `20230601`. | string | Yes | - | - |

**Example Request:**

```bash
curl -X GET "https://prod.api.market/api/v1/api-factory-1/email-domain-intelligence/v1/dkim?domain=gmail.com&selector=20230601" \
  -H "x-api-market-key: YOUR_API_KEY"
```

**Example Response (200 OK):**

```json
{
  "data": {
    "domain": "gmail.com",
    "selector": "20230601",
    "dkim": {
      "status": "not_configured",
      "configured": true,
      "lookup_status": "ok",
      "domain": "gmail.com",
      "selector": "20230601",
      "queried_name": "20230601._domainkey.gmail.com",
      "record": "v=DKIM1; k=rsa; p=",
      "key_type": "rsa",
      "public_key_present": false,
      "flags": [],
      "warnings": [
        {
          "code": "DKIM_PUBLIC_KEY_MISSING",
          "severity": "high",
          "message": "The DKIM record has no public key value.",
          "field": "dkim.public_key_present"
        }
      ]
    },
    "meta": {
      "request_id": "20277d76-154f-44ad-a2a2-e33f6b2cba88",
      "checked_at": "2026-10-06T06:19:11.438Z",
      "dns_provider": "Cloudflare 1.1.1.1 DNS-over-HTTPS JSON",
      "data_retention": "none"
    }
  },
  "requestId": "20277d76-154f-44ad-a2a2-e33f6b2cba88"
}
```

## Status Codes

| Code | Status | Description |
|---|---|---|
| 200 | OK | Analysis returned. A domain that does not exist (NXDOMAIN) is also reported in a 200 response. |
| 400 | Bad Request | `domain` or `selector` is missing or invalid, for example an IP address or an email address. The body has an `error.code` such as `INVALID_DOMAIN`. |
| 401 | Unauthorized | Missing or invalid `x-api-market-key` header. |
| 429 | Too Many Requests | You exceeded your plan's requests-per-second limit. |
| 500 | Internal Server Error | Unexpected server error. Retry the request. |

## Rate Limits

Requests per second depend on your plan: BASIC 1, PRO 2, ULTRA 3 and MEGA 5. BASIC is a free trial with 100 calls. PRO includes 10,000 calls a month ($5.99), ULTRA 50,000 ($19.99) and MEGA 150,000 ($49.99). All plans use hard limits, so requests stop at the quota instead of incurring overage. On a 429, wait and retry with backoff.

## FAQ

*   **Does this verify an individual email address?**

    No. It inspects public DNS for a domain. It does not contact mailboxes or run SMTP checks.

*   **Is the score a deliverability prediction?**

    No. It measures the observed DNS configuration only, not whether messages will reach the inbox.

*   **Why do I need to pass a DKIM selector?**

    Selectors cannot be listed from DNS. Without one, DKIM is reported as `selector_required` and left out of the score.

*   **Does it fully validate MTA-STS and BIMI?**

    It checks the MTA-STS DNS record but does not fetch the HTTPS policy file. BIMI records are reported, but logos and certificates are not verified.

*   **Why is the email provider "unknown" for some domains?**

    The provider is only named when the MX evidence is strong, so some domains return `unknown` with confidence `none`.

## Contact Us

If you have any questions or need assistance, you can reach out to us through the embedded chat on the bottom right corner of the page or send an email to hello@magicapi.com.


Check MX, SPF, DMARC, DKIM, DNSSEC and domain email security in one API. Get configuration scores, warnings and recommendations.

Email Domain Intelligence API | SPF, DMARC, DKIM & MX

BASIC